The Apache Sling Security Bundle ReferrerFilter accepts referrer evidence that is weaker than the originating authority, as stated in the vulnerability description. This weakness can be exploited to craft or modify the Referer header in HTTP requests. The impact, inferred from the nature of the weakness, is that components or applications that rely on strict origin validation could be bypassed, potentially allowing unauthorized access to protected resources. That specific extrapolation is inferred, not explicitly confirmed by the CVE text.

All installations of the Apache Sling Security Bundle that are running a version earlier than 1.3.2 are affected, regardless of deployment environment. The vulnerability is present in any release before the fix included in bundle version 1.3.2.

The CVSS base score of 7.3 denotes moderate to high severity. The EPSS score of less than 1% indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The CPE text does not describe a specific exploitation technique; possible exploitation would likely involve an attacker sending HTTP requests with a forged Referer header, but that scenario is inferred from the vulnerability mechanism rather than stated in the CVE description.