PT-2023-19935 · Oracle+1 · Jdk+1

Xun Bai · Publicado 2023-02-14 · Atualizado 2023-02-22 · CVE-2023-25141

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Sling JCR Base versions prior to 3.1.12

Description The issue is related to a critical injection vulnerability in Apache Sling JCR Base when running on old JDK versions, specifically JDK 1.8.191 or earlier. This vulnerability occurs through utility functions in RepositoryAccessor, particularly the getRepository and getRepositoryFromURL functions, which allow an application to access data stored in a remote location via JDNI and RMI.

Recommendations For Apache Sling JCR Base versions prior to 3.1.12, upgrade to Apache Sling JCR Base 3.1.12 or later. Alternatively, run Apache Sling JCR Base on a more recent JDK version to mitigate the issue.

Correção

Special Elements Injection

Enumeração de Fraquezas

CWE-74

Identificadores relacionados

CVE-2023-25141

GHSA-GVG3-83Q4-RFHQ

Produtos afetados

Apache Sling Jcr Base

Jdk

Referências · 9

• https://github.com/apache/sling-org-apache-sling-jcr-base/commit/779d8a7dd0437a4f31de02c0d995afcf83b9904b · Nota
• https://github.com/apache/sling-org-apache-sling-jcr-base/commit/6ed0a030fd5f13774aff0073c55cbe3ace0153cb · Nota
• https://github.com/apache/sling-org-apache-sling-jcr-base · Nota
• https://osv.dev/vulnerability/CVE-2023-25141 · Aviso do Fabricante
• https://sling.apache.org/news.html · Aviso do Fabricante
• https://t.me/cibsecurity/58102 · Publicação no Telegram
• https://issues.apache.org/jira/browse/SLING-11770 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-25141 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-gvg3-83q4-rfhq · Aviso do Fabricante