CVE-2017-15700: Apache Sling Authentication Service Vulnerability
Summary
CVE-2017-15700: Apache Sling Authentication Service vulnerability. Affects org.apache.sling:org.apache.sling.auth.core versions >= 1.4.0, < 1.4.2. Fixed in 1.4.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Apache Sling Authentication Service is a component of the Apache Sling framework, which provides a web framework for building content-oriented applications. The Authentication Service is responsible for handling user authentication and authorization within the Sling framework. It allows users to log in and access protected resources based on their credentials. However, a vulnerability has been discovered in version 1.4.0 of the Authentication Service, which could be exploited by an attacker to trick users into disclosing their credentials.
Vulnerability Detail
The vulnerability, identified as CVE-2017-15700, resides in the org.apache.sling.auth.core.AuthUtil#isRedirectValid method of the Apache Sling Authentication Service. Through the Sling login form, an attacker can manipulate the redirect URL and trick a victim into sending their credentials to a malicious site. This can lead to unauthorized access to sensitive information and potential account compromise. The vulnerability has a CVSSv3 score of 8.8, indicating a high severity level.
How To Fix
Latest published version: 2.1.2 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.4.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the patched version is not immediately feasible, a temporary workaround is to disable the Sling login form or implement additional validation checks for redirect URLs. This can be done by modifying the application's configuration to restrict the allowed redirect URLs or by customizing the login form to prevent manipulation of the redirect URL parameter.
Conclusion
The Apache Sling Authentication Service version 1.4.0 is vulnerable to a flaw that allows attackers to trick users into disclosing their credentials. Upgrading to version 1.4.2 or applying the recommended workarounds will mitigate the risk of unauthorized access and potential account compromise.
See every vulnerability recorded for org.apache.sling:org.apache.sling.auth.core →
FAQ
The vulnerability allows an attacker to trick users into disclosing their credentials, potentially leading to unauthorized access to sensitive information and account compromise.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities using just the pom.xml file.
Yes, upgrading to version 1.4.2 of the Apache Sling Authentication Service fixes this vulnerability. It is recommended to update your application's dependencies to use the patched version.
If immediate upgrading is not possible, you can temporarily disable the Sling login form or implement additional validation checks for redirect URLs to mitigate the risk.
The CVSSv3 score of this vulnerability is 8.8, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.sling:org.apache.sling.auth.core.
