TI-2012-01911 Aliases CVE-2012-2138 GHSA-342c-f869-5m44

The @CopyFrom operation in the POST servlet in the org.apache.sling.servlets.post bundle…

LOW 38CWE-264Published 2012-07-09 · Updated 2024-09-16

Key facts

Attack vector: Network
Privileges required: None
User interaction: — Not recorded in CVSS 2.0
Attack complexity: Low
Impact type: Security bypass, Denial of service
Confidentiality · integrity · availability: None · None · Partial
Fix status: Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-264 and CWE-400.

Summary

The @CopyFrom operation in the POST servlet in the org.apache.sling.servlets.post bundle before 2.1.2 in Apache Sling does not prevent attempts to copy an ancestor node to a descendant node, which allows remote attackers to cause a denial of service (infinite loop) via a crafted HTTP request.

Why it matters now

EPSS 0.14122 96th percentileScored 2026-11-07

Fix Fixed org.apache.sling:org.apache.sling.servlets.post (Maven): 2.1.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA
—	org.apache.sling:org.apache.sling.servlets.post (Maven)	before 2.1.2	2.1.2	Patch available	GHSA-342c-f869-5m44

— Vendor— Affected all versions Fixed in — No fix listed CNA
org.apache.sling:org.apache.sling.servlets.post (Maven) Vendor— Affected before 2.1.2 Fixed in 2.1.2 Patch available GHSA-342c-f869-5m44

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:apache:org.apache.sling.servlets.post::::::::	up to 2.1.0	Vulnerable	Apache
cpe:2.3:a:apache:sling::::::::	all versions	Running on	Apache

cpe:2.3:a:apache:org.apache.sling.servlets.post:*:*:*:*:*:*:*:* Versions up to 2.1.0 Vulnerable ·Apache
cpe:2.3:a:apache:sling:*:*:*:*:*:*:*:* Versions all versions Running on ·Apache

Remediation

Fix · GHSA-342c-f869-5m44 org.apache.sling:org.apache.sling.servlets.post (Maven) Fixed in 2.1.2 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2012-2138
2026-10-03 Alias added: GHSA-342c-f869-5m44

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2012-2138

Other 5

TI-2013-02014 The deepGetOrCreateNode function in impl/operations/AbstractCreateOperation.java in… CVSS 2.0MEDIUM 5.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences