PT-2023-14581 · Apache · Apache Sling Engine

Lars Krapf · Published 2023-04-13 · Updated 2025-06-13 · CVE-2022-45064

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Sling Engine versions prior to 2.14.0

Description The SlingRequestDispatcher doesn't correctly implement the RequestDispatcher API, resulting in include-based cross-site scripting issues on the Apache Sling level. An attacker who can include a resource with a specific content-type and control the include path can exploit this issue, leading to privilege escalation to administrative power.

Recommendations Update to Apache Sling Engine version 2.14.0 or newer and enable the "Check Content-Type overrides" configuration option.

Fix

LPE

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-45064

GHSA-MG46-F9H5-G27X

Affected Products

Apache Sling Engine

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2022-45064 · Security Note
• https://lists.apache.org/thread/hhp611hltby3whk03vx2mv7cmy3vs0ok · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-45064 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mg46-f9h5-g27x · Vendor Advisory
• https://github.com/apache/sling-org-apache-sling-engine · Note
• https://t.me/cvenotify/48146 · Telegram Post
• http://openwall.com/lists/oss-security/2023/04/18/6 · Note
• https://t.me/cibsecurity/62054 · Telegram Post
• https://t.me/cvenotify/125662 · Telegram Post
• https://t.me/cvenotify/49504 · Telegram Post