PT-2023-14581 · Apache · Apache Sling Engine

Lars Krapf · Publicado 2023-04-13 · Atualizado 2025-06-13 · CVE-2022-45064

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Crítica

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Sling Engine versions prior to 2.14.0

Description The SlingRequestDispatcher doesn't correctly implement the RequestDispatcher API, resulting in include-based cross-site scripting issues on the Apache Sling level. An attacker who can include a resource with a specific content-type and control the include path can exploit this issue, leading to privilege escalation to administrative power.

Recommendations Update to Apache Sling Engine version 2.14.0 or newer and enable the "Check Content-Type overrides" configuration option.

Correção

LPE

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2022-45064

GHSA-MG46-F9H5-G27X

Produtos afetados

Apache Sling Engine

Referências · 10

• https://github.com/apache/sling-org-apache-sling-engine · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2022-45064 · Nota de Segurança
• https://lists.apache.org/thread/hhp611hltby3whk03vx2mv7cmy3vs0ok · Aviso do Fabricante
• https://t.me/cvenotify/48146 · Publicação no Telegram
• http://openwall.com/lists/oss-security/2023/04/18/6 · Nota
• https://osv.dev/vulnerability/CVE-2022-45064 · Aviso do Fabricante
• https://t.me/cibsecurity/62054 · Publicação no Telegram
• https://t.me/cvenotify/125662 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-mg46-f9h5-g27x · Aviso do Fabricante
• https://t.me/cvenotify/49504 · Publicação no Telegram