CVE-2013-4390
Apache Sling Auth Core bundle vulnerable to Open Redirection
Open redirect vulnerability in the AbstractAuthenticationFormServlet in the Auth Core (org.apache.sling.auth.core) bundle before 1.1.4 in Apache Sling allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the resource parameter, related to "a custom login form and XSS."
Exploit likelihood
What each source reports
NVD Score used
Open redirect vulnerability in the AbstractAuthenticationFormServlet in the Auth Core (org.apache.sling.auth.core) bundle before 1.1.4 in Apache Sling allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the resource parameter, related to "a custom login form and XSS."
- Record
CVE-2013-4390- CVSS 2.0
- 5.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
Open redirect vulnerability in the AbstractAuthenticationFormServlet in the Auth Core (org.apache.sling.auth.core) bundle before 1.1.4 in Apache Sling allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the resource parameter, related to "a custom login form and XSS."
- Record
CVE-2013-4390- Updated
- 2026-11-02
EUVDEUVD-2022-4301 No score
Open redirect vulnerability in the AbstractAuthenticationFormServlet in the Auth Core (org.apache.sling.auth.core) bundle before 1.1.4 in Apache Sling allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the resource parameter, related to "a custom login form and XSS."
- Record
EUVD-2022-4301- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-j7f2-cqvq-5jcf
Apache Sling Auth Core bundle vulnerable to Open Redirection
Open redirect vulnerability in the AbstractAuthenticationFormServlet in the Auth Core (org.apache.sling.auth.core) bundle before 1.1.4 in Apache Sling allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the resource parameter, related to "a custom login form and XSS."
- Record
GHSA-j7f2-cqvq-5jcf- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
OSVGHSA-j7f2-cqvq-5jcf
Apache Sling Auth Core bundle vulnerable to Open Redirection
Open redirect vulnerability in the AbstractAuthenticationFormServlet in the Auth Core (org.apache.sling.auth.core) bundle before 1.1.4 in Apache Sling allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the resource parameter, related to "a custom login form and XSS."
- Record
GHSA-j7f2-cqvq-5jcf- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.sling:org.apache.sling.auth.coreMaven |
before 1.1.4 | 1.1.4 |
org.apache.sling:org.apache.sling.auth.coreMaven |
before 1.1.4, plus listed versions 1.0.01.0.21.0.41.0.61.1.01.1.2 |
1.1.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-4390 is a medium vulnerability (CVSS 5.8) in Apache Sling, published October 24, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.06%, the 87th percentile. Fixed in org.apache.sling:org.apache.sling.auth.core 1.1.4.
References
issues.apache.org/jira/browse/SLING-3141
securityfocus.com/bid/63241
mail-archives.apache.org/mod_mbox/sling-dev/201310.mbox/%3CCAKkCf4qdFxEW9NXBJoMsrBama8LFNyir%2B61A0Vfzp4njEpeU%3Dw%40mail.gmail.com%3E
secunia.com/advisories/55249
nvd.nist.gov/vuln/detail/CVE-2013-4390
github.com/apache/sling-org-apache-sling-auth-core/commit/d1cd9aaa3432d577b65c50b3fbdc36d5d667ca46