CVE-2012-2138

Published: Jul 9, 2012Modified: Apr 29, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

The @CopyFrom operation in the POST servlet in the org.apache.sling.servlets.post bundle before 2.1.2 in Apache Sling does not prevent attempts to copy an ancestor node to a descendant node, which allows remote attackers to cause a denial of service (infinite loop) via a crafted HTTP request.

Affected (1)

Products: Apache: Org.apache.sling.servlets.post

1 product

Org.apache.sling.servlets.post

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Apache Org.apache.sling.servlets.post	Up to 2.1.0

Running on/with	Platform Versions
Apache Sling	All versions

Related CWEs

References (6)

http://mail-archives.apache.org/mod_mbox/www-announce/201207.mbox/%3CCAEWfVJ=PwoQmwJg0KmbrC17Gw51kgfKRsqgy=4RpMQsdGh0bVg%40mail.gmail.com%3E

Source: secalert@redhat.com

http://svn.apache.org/viewvc?view=revision&revision=1352865

Source: secalert@redhat.com

https://issues.apache.org/jira/browse/SLING-2517

Source: secalert@redhat.com

http://mail-archives.apache.org/mod_mbox/www-announce/201207.mbox/%3CCAEWfVJ=PwoQmwJg0KmbrC17Gw51kgfKRsqgy=4RpMQsdGh0bVg%40mail.gmail.com%3E

Source: af854a3a-2127-422b-91ae-364da2661108

http://svn.apache.org/viewvc?view=revision&revision=1352865

Source: af854a3a-2127-422b-91ae-364da2661108

https://issues.apache.org/jira/browse/SLING-2517

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.