PT-2023-19935 · Oracle+1 · Jdk+1

Xun Bai · Published 2023-02-14 · Updated 2023-02-22 · CVE-2023-25141

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Sling JCR Base versions prior to 3.1.12

Description The issue is related to a critical injection vulnerability in Apache Sling JCR Base when running on old JDK versions, specifically JDK 1.8.191 or earlier. This vulnerability occurs through utility functions in RepositoryAccessor, particularly the getRepository and getRepositoryFromURL functions, which allow an application to access data stored in a remote location via JDNI and RMI.

Recommendations For Apache Sling JCR Base versions prior to 3.1.12, upgrade to Apache Sling JCR Base 3.1.12 or later. Alternatively, run Apache Sling JCR Base on a more recent JDK version to mitigate the issue.

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2023-25141

GHSA-GVG3-83Q4-RFHQ

Affected Products

Apache Sling Jcr Base

Jdk

References · 9

• https://osv.dev/vulnerability/CVE-2023-25141 · Vendor Advisory
• https://sling.apache.org/news.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-25141 · Security Note
• https://osv.dev/vulnerability/GHSA-gvg3-83q4-rfhq · Vendor Advisory
• https://github.com/apache/sling-org-apache-sling-jcr-base/commit/779d8a7dd0437a4f31de02c0d995afcf83b9904b · Note
• https://github.com/apache/sling-org-apache-sling-jcr-base/commit/6ed0a030fd5f13774aff0073c55cbe3ace0153cb · Note
• https://github.com/apache/sling-org-apache-sling-jcr-base · Note
• https://t.me/cibsecurity/58102 · Telegram Post
• https://issues.apache.org/jira/browse/SLING-11770 · Note