PT-2023-20692 · Apache · Apache Sling Resource Merger

Alex Collignon · Publicado 2023-03-20 · Atualizado 2023-03-29 · CVE-2023-26513

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache Sling Resource Merger versions 1.2.0 through 1.4.2

Description The issue is related to an Excessive Iteration vulnerability in the Apache Sling Resource Merger.

Recommendations For versions 1.2.0 through 1.4.2, update to version 1.4.2 or later to resolve the issue.

Correção

Enumeração de Fraquezas

CWE-834

Identificadores relacionados

CVE-2023-26513

GHSA-RWRX-X2HW-9H5W

Produtos afetados

Apache Sling Resource Merger

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-26513 · Nota de Segurança
• https://t.me/cibsecurity/60316 · Publicação no Telegram
• https://lists.apache.org/thread/xpcpo1y88ldss5hgmvogsf6h3735l5zb · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-26513 · Aviso do Fabricante
• https://issues.apache.org/jira/browse/SLING-11776 · Nota
• https://osv.dev/vulnerability/GHSA-rwrx-x2hw-9h5w · Aviso do Fabricante