CVE-2024-23673

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-23673
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-23673.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-23673
Aliases
Published
2024-02-06T10:15:08Z
Modified
2024-09-03T04:38:30.620435Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

Malicious code execution via path traversal in Apache Software Foundation Apache Sling Servlets Resolver.This issue affects all version of Apache Sling Servlets Resolver before 2.11.0. However, whether a system is vulnerable to this attack depends on the exact configuration of the system. If the system is vulnerable, a user with write access to the repository might be able to trick the Sling Servlet Resolver to load a previously uploaded script. 

Users are recommended to upgrade to version 2.11.0, which fixes this issue. It is recommended to upgrade, regardless of whether your system configuration currently allows this attack or not.

References

Affected packages

Git / github.com/apache/sling-org-apache-sling-servlets-resolver

Affected ranges

Type
GIT
Repo
https://github.com/apache/sling-org-apache-sling-servlets-resolver
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
37438b942426a0022add0e7b99b0b84c1e554f70

Affected versions

org.*

org.apache.sling.servlets.resolver-2.10.0
org.apache.sling.servlets.resolver-2.4.16
org.apache.sling.servlets.resolver-2.4.18
org.apache.sling.servlets.resolver-2.4.20
org.apache.sling.servlets.resolver-2.4.22
org.apache.sling.servlets.resolver-2.4.24
org.apache.sling.servlets.resolver-2.5.2
org.apache.sling.servlets.resolver-2.5.4
org.apache.sling.servlets.resolver-2.5.6
org.apache.sling.servlets.resolver-2.5.8
org.apache.sling.servlets.resolver-2.6.0
org.apache.sling.servlets.resolver-2.6.2
org.apache.sling.servlets.resolver-2.6.4
org.apache.sling.servlets.resolver-2.7.0
org.apache.sling.servlets.resolver-2.7.10
org.apache.sling.servlets.resolver-2.7.12
org.apache.sling.servlets.resolver-2.7.14
org.apache.sling.servlets.resolver-2.7.2
org.apache.sling.servlets.resolver-2.7.4
org.apache.sling.servlets.resolver-2.7.6
org.apache.sling.servlets.resolver-2.7.8
org.apache.sling.servlets.resolver-2.8.0
org.apache.sling.servlets.resolver-2.8.2
org.apache.sling.servlets.resolver-2.9.0
org.apache.sling.servlets.resolver-2.9.10
org.apache.sling.servlets.resolver-2.9.12
org.apache.sling.servlets.resolver-2.9.14
org.apache.sling.servlets.resolver-2.9.2
org.apache.sling.servlets.resolver-2.9.4
org.apache.sling.servlets.resolver-2.9.6
org.apache.sling.servlets.resolver-2.9.8