PT-2023-20199 · Apache · Apache Sling

Publicado 2023-02-23 · Atualizado 2025-03-18 · CVE-2023-25621

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache Sling versions prior to 2.6.2

Description A privilege escalation issue exists in the i18n module of Apache Sling, allowing any content author to create i18n dictionaries in the repository in a location they have write access to. These translations are used across the whole product, enabling an author to change any text or dialog in the product. For example, an attacker might fool someone by changing the text on a delete button to "Info".

Recommendations Update to version 2.6.2 or higher, check the configuration for resource loading, and then adjust the access permissions for the configured path accordingly.

Correção

Improper Privilege Management

Enumeração de Fraquezas

CWE-269

Identificadores relacionados

CVE-2023-25621

GHSA-MRPV-5PMR-P92H

Produtos afetados

Apache Sling

Referências · 10

• https://github.com/apache/sling-org-apache-sling-i18n/pull/9 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-25621 · Nota de Segurança
• https://t.me/breachdetector/207052 · Publicação no Telegram
• https://t.me/cvenotify/115148 · Publicação no Telegram
• https://issues.apache.org/jira/browse/SLING-11744 · Nota
• https://t.me/cibsecurity/58770 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-25621 · Aviso do Fabricante
• https://seclists.org/oss-sec/2023/q1/112 · Nota
• https://sling.apache.org/news.html · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-mrpv-5pmr-p92h · Aviso do Fabricante