PT-2023-19935
CVE-2023-25141
·
تاريخ النشر
2023-02-14
·
تاريخ التحديث
2023-02-22
الوصف من
CVSS 3.1
7.5
عاليةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions
Apache Sling JCR Base versions prior to 3.1.12
Description
The issue is related to a critical injection vulnerability in Apache Sling JCR Base when running on old JDK versions, specifically JDK 1.8.191 or earlier. This vulnerability occurs through utility functions in RepositoryAccessor, particularly the
getRepository and getRepositoryFromURL functions, which allow an application to access data stored in a remote location via JDNI and RMI.Recommendations
For Apache Sling JCR Base versions prior to 3.1.12, upgrade to Apache Sling JCR Base 3.1.12 or later.
Alternatively, run Apache Sling JCR Base on a more recent JDK version to mitigate the issue.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾