GHSA-gvg3-83q4-rfhq

Command injection in Apache Sling

Source: GitHub Advisory Database (reviewed) High CVE-2023-25141

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.apache.sling:org.apache.sling.jcr.base	< 3.1.12	3.1.12

Details

As written in the advisory (Markdown source, shown as plain text).

Apache Sling JCR Base < 3.1.12 has a critical injection vulnerability when running on old JDK versions (JDK 1.8.191 or earlier) through utility functions in RepositoryAccessor. The functions getRepository and getRepositoryFromURL allow an application to access data stored in a remote location via JDNI and RMI. Users of Apache Sling JCR Base are recommended to upgrade to Apache Sling JCR Base 3.1.12 or later, or to run on a more recent JDK.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-25141 advisory
https://github.com/apache/sling-org-apache-sling-jcr-base/commit/6ed0a030fd5f13774aff0073c55cbe3ace0153cb web
https://github.com/apache/sling-org-apache-sling-jcr-base/commit/779d8a7dd0437a4f31de02c0d995afcf83b9904b web
https://github.com/apache/sling-org-apache-sling-jcr-base package
https://issues.apache.org/jira/browse/SLING-11770 web
https://sling.apache.org/news.html web