CVE-2012-2138
NoneCVSS
—
EPSS
14.1%
Published
Jul 9, 2012
CISA due date
—
The record
The @CopyFrom operation in the POST servlet in the org.apache.sling.servlets.post bundle before 2.1.2 in Apache Sling does not prevent attempts to copy an ancestor node to a descendant node, which allows remote attackers to cause a denial of service (infinite loop) via a crafted HTTP request.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.apache.sling:org.apache.sling.servlets.post | 0 | 2.1.2 |
Related vulnerabilities
- CVE-2016-0956 The Servlets Post component 2.3.6 in Apache Sling, as used in Adobe Experience Manager… Also affects org.apache.sling:org.apache.sling.servlets.post
- CVE-2026-81644 DoS vulnerability in the preview service module. CWE-264
- CVE-2026-49315 DoS vulnerability in the input device module. CWE-264
- CVE-2026-49313 Permission control vulnerability in the app lock module. CWE-264
- CVE-2026-49312 Permission control vulnerability in the window module. CWE-264
- CVE-2026-49310 Permission control vulnerability in the event notification module. CWE-264
- CVE-2026-41987 Permission control vulnerability in the app management module. CWE-264
- CVE-2026-49309 Permission control vulnerability in the Settings module. CWE-264