Apache Org.apache.sling.servlets.post vulnerabilities

2 CVEs affecting Apache Org.apache.sling.servlets.post, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2013-2254, published 2013-10-17.

More from Apache.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2012-2138, published 2012-07-09. Medium severity, CVSS 5.0. EPSS: 14.1% chance of exploitation in the next 30 days. The @CopyFrom operation in the POST servlet in the org.apache.sling.servlets.post bundle before 2.1.2 in Apache Sling does not prevent attempts to copy an ancestor node to a descendant node, which…
• CVE-2013-2254, published 2013-10-17. Medium severity, CVSS 5.0. EPSS: 4.1% chance of exploitation in the next 30 days. The deepGetOrCreateNode function in impl/operations/AbstractCreateOperation.java in org.apache.sling.servlets.post.bundle 2.2.0 and 2.3.0 in Apache Sling does not properly handle a NULL value that…