PT-2023-20199 · Apache · Apache Sling

Published 2023-02-23 · Updated 2025-03-18 · CVE-2023-25621

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache Sling versions prior to 2.6.2

Description A privilege escalation issue exists in the i18n module of Apache Sling, allowing any content author to create i18n dictionaries in the repository in a location they have write access to. These translations are used across the whole product, enabling an author to change any text or dialog in the product. For example, an attacker might fool someone by changing the text on a delete button to "Info".

Recommendations Update to version 2.6.2 or higher, check the configuration for resource loading, and then adjust the access permissions for the configured path accordingly.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2023-25621

GHSA-MRPV-5PMR-P92H

Affected Products

Apache Sling

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2023-25621 · Security Note
• https://osv.dev/vulnerability/CVE-2023-25621 · Vendor Advisory
• https://sling.apache.org/news.html · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mrpv-5pmr-p92h · Vendor Advisory
• https://github.com/apache/sling-org-apache-sling-i18n/pull/9 · Note
• https://t.me/breachdetector/207052 · Telegram Post
• https://t.me/cvenotify/115148 · Telegram Post
• https://issues.apache.org/jira/browse/SLING-11744 · Note
• https://t.me/cibsecurity/58770 · Telegram Post
• https://seclists.org/oss-sec/2023/q1/112 · Note