CVE-2013-2254

Currently unrated

Key Information:

Vendor
Apache
Status
Org.apache.sling.servlets.post
Vendor
CVE Published:
17 October 2013

Summary

The deepGetOrCreateNode function in impl/operations/AbstractCreateOperation.java in org.apache.sling.servlets.post.bundle 2.2.0 and 2.3.0 in Apache Sling does not properly handle a NULL value that returned when the session does not have permissions to the root node, which allows remote attackers to cause a denial of service (infinite loop) via unspecified vectors.

References

http://mail-archives.apache.org/mod_mbox/sling-dev/201310...
mailing-listx_refsource_MLIST
http://secunia.com/advisories/55157
third-party-advisoryx_refsource_SECUNIA
http://www.securityfocus.com/bid/62903
vdb-entryx_refsource_BID

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.