PT-2022-21360 · Apache · Apache Sling+1

Alex Collignon · Published 2022-06-22 · Updated 2022-06-29 · CVE-2022-32549

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache Sling Commons Log versions 5.4.0 and earlier Apache Sling API versions 2.25.0 and earlier

Description The issue allows an attacker to forge logs, potentially covering their tracks by injecting fake logs and corrupting log files. This is due to a log injection vulnerability.

Recommendations For Apache Sling Commons Log versions 5.4.0 and earlier, update to a version later than 5.4.0 to resolve the issue. For Apache Sling API versions 2.25.0 and earlier, update to a version later than 2.25.0 to resolve the issue. As a temporary workaround, consider restricting access to log files to minimize the risk of exploitation.

Fix

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-116

CWE-117

Related Identifiers

CVE-2022-32549

GHSA-QMX3-M648-HR74

Affected Products

Apache Sling

Apache Sling Commons Log

References · 5

• https://osv.dev/vulnerability/CVE-2022-32549 · Vendor Advisory
• https://lists.apache.org/thread/7z6h3806mwcov5kx6l96pq839sn0po1v · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-32549 · Security Note
• https://osv.dev/vulnerability/GHSA-qmx3-m648-hr74 · Vendor Advisory
• https://t.me/cibsecurity/44945 · Telegram Post