WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Vendor org.apache.sling✕
Overview 22 matches · 21 in Waratek scope · 2 protected · 0 exploited · 0 CISA KEV · 2 public PoC · 1 EPSS ≥ 0.5
22matches 21in Waratek scope95.5% 2protected9.1% 0exploited0.0% 0CISA KEV0.0% 2public PoC9.1% 1EPSS ≥ 0.54.5%
Protected by Waratek 2 9.1% Rule in development 0 0.0% Mitigation candidate 2 9.1% No exploit published 17 77.3% Outside Waratek scope 0 0.0% Not applicable 1 4.5% Withdrawn CVE 0 0.0%
Critical 3 13.6% High 7 31.8% Medium 12 54.5% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 2 9.1% partly blocked 0 0.0% not blocked 20 90.9% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 2 9.1% Proof of concept only 1 4.5% Forecast only 0 0.0% No public exploit 19 86.4%
split by peak 7 / year
Not applicable: 1No exploit published: 17Mitigation candidate: 2Protected by Waratek: 2 Medium: 12High: 7Critical: 3 not blocked: 20blocked by ARMR today: 2 No public exploit: 19Proof of concept only: 1Working exploit published: 2
20121 Mitigation candidate1 Medium1 not blocked1 Working exploit published1 20132 No exploit published2 Medium2 not blocked2 No public exploit2 20140 20151 No exploit published1 Medium1 not blocked1 No public exploit1 20161 Mitigation candidate1 High1 not blocked1 Working exploit published1 20174 Protected by Waratek1 No exploit published2 Not applicable1 Critical1 High1 Medium2 blocked by ARMR today1 not blocked3 No public exploit4 20182 No exploit published2 High1 Medium1 not blocked2 No public exploit2 20190 20200 20211 No exploit published1 High1 not blocked1 No public exploit1 20222 No exploit published2 Medium2 not blocked2 No public exploit2 20237 No exploit published7 Critical2 High2 Medium3 not blocked7 No public exploit7 20241 Protected by Waratek1 High1 blocked by ARMR today1 Proof of concept only1
2012201420162018202020222024
22 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2024-23673 High 2024-02-06 Protected by Waratek Proof of concept only Malicious code execution via path traversal in Apache Software Foundation Apache Sling Servlets Resolver.This issue affects all version of Apache Sling Servlets Resolver before 2.11.0. However, whether a system is vulnerable to this attack depends on the exact configuration of the system. If the system is vulnerable, a user with write access to the repository might be able to trick the Sling Servlet Resolver to load a previously uploaded script.  Users are recommended to upgrade to version 2.11.0, which fixes this issue. It is recommended to upgrade, regardless of whether your system configuration currently allows this attack or not.
CVE-2022-47937 Critical 2023-05-15 No exploit published No public exploit Improper input validation in the Apache Sling Commons JSON bundle allows an attacker to trigger unexpected errors by supplying specially-crafted input. The org.apache.sling.commons.json bundle has been deprecated as of March 2017 and should not be used anymore. Consumers are encouraged to consider the Apache Sling Commons Johnzon OSGi bundle provided by the Apache Sling project, but may of course use other JSON libraries.
CVE-2022-45064 Critical 2023-04-13 No exploit published No public exploit The SlingRequestDispatcher doesn't correctly implement the RequestDispatcher API resulting in a generic type of include-based cross-site scripting issues on the Apache Sling level. The vulnerability is exploitable by an attacker that is able to include a resource with specific content-type and control the include path (i.e. writing content). The impact of a successful attack is privilege escalation to administrative power. Please update to Apache Sling Engine >= 2.14.0 and enable the "Check Content-Type overrides" configuration option.
CVE-2023-26513 High 2023-03-20 No exploit published No public exploit Excessive Iteration vulnerability in Apache Software Foundation Apache Sling Resource Merger.This issue affects Apache Sling Resource Merger: from 1.2.0 before 1.4.2.
CVE-2023-25621 Medium 2023-02-23 No exploit published No public exploit Privilege Escalation vulnerability in Apache Software Foundation Apache Sling. Any content author is able to create i18n dictionaries in the repository in a location the author has write access to. As these translations are used across the whole product, it allows an author to change any text or dialog in the product. For example an attacker might fool someone by changing the text on a delete button to "Info". This issue affects the i18n module of Apache Sling up to version 2.5.18. Version 2.6.2 and higher limit by default i18m dictionaries to certain paths in the repository (/libs and /apps). Users of the module are advised to update to version 2.6.2 or higher, check the configuration for resource loading and then adjust the access permissions for the configured path accordingly.
CVE-2023-25141 High 2023-02-14 No exploit published No public exploit Apache Sling JCR Base < 3.1.12 has a critical injection vulnerability when running on old JDK versions (JDK 1.8.191 or earlier) through utility functions in RepositoryAccessor. The functions getRepository and getRepositoryFromURL allow an application to access data stored in a remote location via JDNI and RMI. Users of Apache Sling JCR Base are recommended to upgrade to Apache Sling JCR Base 3.1.12 or later, or to run on a more recent JDK.
CVE-2023-22849 Medium 2023-02-04 No exploit published No public exploit An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Sling App CMS version 1.1.4 and prior may allow an authenticated remote attacker to perform a reflected cross-site scripting (XSS) attack in multiple features. Upgrade to Apache Sling App CMS >= 1.1.6
CVE-2022-46769 Medium 2023-01-09 No exploit published No public exploit An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Sling App CMS version 1.1.2 and prior may allow an authenticated remote attacker to perform a reflected cross-site scripting (XSS) attack in the site group feature. Upgrade to Apache Sling App CMS >= 1.1.4
CVE-2022-43670 Medium 2022-11-02 No exploit published No public exploit An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Sling App CMS version 1.1.0 and prior may allow an authenticated remote attacker to perform a reflected cross site scripting (XSS) attack in the taxonomy management feature.
CVE-2022-32549 Medium 2022-06-22 No exploit published No public exploit Apache Sling Commons Log <= 5.4.0 and Apache Sling API <= 2.25.0 are vulnerable to log injection. The ability to forge logs may allow an attacker to cover tracks by injecting fake logs and potentially corrupt log files.
CVE-2021-44549 High 2021-12-14 No exploit published No public exploit Apache Sling Commons Messaging Mail provides a simple layer on top of JavaMail/Jakarta Mail for OSGi to send mails via SMTPS. To reduce the risk of "man in the middle" attacks additional server identity checks must be performed when accessing mail servers. For compatibility reasons these additional checks are disabled by default in JavaMail/Jakarta Mail. The SimpleMailService in Apache Sling Commons Messaging Mail 1.0 lacks an option to enable these checks for the shared mail session. A user could enable these checks nevertheless by accessing the session via the message created by SimpleMessageBuilder and setting the property mail.smtps.ssl.checkserveridentity to true. Apache Sling Commons Messaging Mail 2.0 adds support for enabling server identity checks and these checks are enabled by default. - https://javaee.github.io/javamail/docs/SSLNOTES.txt - https://javaee.github.io/javamail/docs/api/com/sun/mail/smtp/package-summary.html - https://github.com/eclipse-ee4j/mail/issues/429
CVE-2017-15717 Medium 2018-01-10 No exploit published No public exploit A flaw in the way URLs are escaped and encoded in the org.apache.sling.xss.impl.XSSAPIImpl#getValidHref and org.apache.sling.xss.impl.XSSFilterImpl#isValidHref allows special crafted URLs to pass as valid, although they carry XSS payloads. The affected versions are Apache Sling XSS Protection API 1.0.4 to 1.0.18, Apache Sling XSS Protection API Compat 1.1.0 and Apache Sling XSS Protection API 2.0.0.
CVE-2012-3353 High 2018-01-09 No exploit published No public exploit The Apache Sling JCR ContentLoader 2.1.4 XmlReader used in the Sling JCR content loader module makes it possible to import arbitrary files in the content repository, including local files, causing potential information leaks. Users should upgrade to version 2.1.6 of the JCR ContentLoader
CVE-2017-15700 High 2017-12-18 No exploit published No public exploit A flaw in the org.apache.sling.auth.core.AuthUtil#isRedirectValid method in Apache Sling Authentication Service 1.4.0 allows an attacker, through the Sling login form, to trick a victim to send over their credentials.
CVE-2017-9802 Medium 2017-08-14 Not applicable No public exploit The Javascript method Sling.evalString() in Apache Sling Servlets Post before 2.3.22 uses the javascript 'eval' function to parse input strings, which allows for XSS attacks by passing specially crafted input strings.
CVE-2016-6798 Critical 2017-07-19 Protected by Waratek No public exploit In the XSS Protection API module before 1.0.12 in Apache Sling, the method XSS.getValidXML() uses an insecure SAX parser to validate the input string, which allows for XXE attacks in all scripts which use this method to validate user input, potentially allowing an attacker to read sensitive data on the filesystem, perform same-site-request-forgery (SSRF), port-scanning behind the firewall or DoS the application.
CVE-2016-5394 Medium 2017-07-19 No exploit published No public exploit In the XSS Protection API module before 1.0.12 in Apache Sling, the encoding done by the XSSAPI.encodeForJSString() method is not restrictive enough and for some input patterns allows script tags to pass through unencoded, leading to potential XSS vulnerabilities.
CVE-2016-0956 High 2016-02-10 Mitigation candidate Working exploit published The Servlets Post component 2.3.6 in Apache Sling, as used in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0, allows remote attackers to obtain sensitive information via unspecified vectors.
CVE-2015-2944 Medium 2015-06-02 No exploit published No public exploit Multiple cross-site scripting (XSS) vulnerabilities in Apache Sling API before 2.2.2 and Apache Sling Servlets Post before 2.1.2 allow remote attackers to inject arbitrary web script or HTML via the URI, related to (1) org/apache/sling/api/servlets/HtmlResponse and (2) org/apache/sling/servlets/post/HtmlResponse.
CVE-2013-4390 Medium 2013-10-24 No exploit published No public exploit Open redirect vulnerability in the AbstractAuthenticationFormServlet in the Auth Core (org.apache.sling.auth.core) bundle before 1.1.4 in Apache Sling allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the resource parameter, related to "a custom login form and XSS."
CVE-2013-2254 Medium 2013-10-17 No exploit published No public exploit The deepGetOrCreateNode function in impl/operations/AbstractCreateOperation.java in org.apache.sling.servlets.post.bundle 2.2.0 and 2.3.0 in Apache Sling does not properly handle a NULL value that returned when the session does not have permissions to the root node, which allows remote attackers to cause a denial of service (infinite loop) via unspecified vectors.
CVE-2012-2138 Medium 2012-07-09 Mitigation candidate Working exploit published The @CopyFrom operation in the POST servlet in the org.apache.sling.servlets.post bundle before 2.1.2 in Apache Sling does not prevent attempts to copy an ancestor node to a descendant node, which allows remote attackers to cause a denial of service (infinite loop) via a crafted HTTP request.