Apache Sling Security Bundle
Monthly
Origin-validation bypass in the Apache Sling Security Bundle before 1.3.2 allows a remote attacker to defeat the ReferrerFilter when that filter is relied upon as the cross-site request protection control, so cross-site requests that should have been blocked are accepted, yielding low-level confidentiality, integrity, and availability impact. Exploitation requires the victim to be lured into a crafted request carrying an authenticated session (CSRF-style user interaction), and only deployments that depend on ReferrerFilter for origin validation are exposed. Apache rates this 7.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), while our independent assessment adjusts the vector to UI:R given the required session-riding interaction; EPSS is only 0.13% (3rd percentile) and there is no public exploit identified at time of analysis.
Content-Disposition enforcement bypass in Apache Sling Security Bundle before 1.3.12 allows remote attackers to circumvent the ContentDispositionFilter by accessing attacker-influenced resources through an alternate URL/API shape not mediated by the filter, potentially causing resources to be served inline rather than as attachments. This protection-mechanism failure (CWE-693) can lead to low confidentiality and integrity impacts, such as information disclosure or client-side script execution, and requires user interaction to open a crafted link. Deployments that rely on this filter for content-disposition protection are affected; no public exploit identified at time of analysis.
Origin-validation bypass in the Apache Sling Security Bundle before 1.3.2 allows a remote attacker to defeat the ReferrerFilter when that filter is relied upon as the cross-site request protection control, so cross-site requests that should have been blocked are accepted, yielding low-level confidentiality, integrity, and availability impact. Exploitation requires the victim to be lured into a crafted request carrying an authenticated session (CSRF-style user interaction), and only deployments that depend on ReferrerFilter for origin validation are exposed. Apache rates this 7.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), while our independent assessment adjusts the vector to UI:R given the required session-riding interaction; EPSS is only 0.13% (3rd percentile) and there is no public exploit identified at time of analysis.
Content-Disposition enforcement bypass in Apache Sling Security Bundle before 1.3.12 allows remote attackers to circumvent the ContentDispositionFilter by accessing attacker-influenced resources through an alternate URL/API shape not mediated by the filter, potentially causing resources to be served inline rather than as attachments. This protection-mechanism failure (CWE-693) can lead to low confidentiality and integrity impacts, such as information disclosure or client-side script execution, and requires user interaction to open a crafted link. Deployments that rely on this filter for content-disposition protection are affected; no public exploit identified at time of analysis.