CVE-2024-23673

Name of the Vulnerable Software and Affected Versions Apache Sling Servlets Resolver versions prior to 2.11.0

Description The issue is related to incorrect restriction of the directory path name in the Apache Sling Servlets Resolver, which can be exploited by a remote attacker to execute arbitrary code. This can be achieved through path traversal, potentially allowing a user with write access to the repository to trick the Sling Servlet Resolver into loading a previously uploaded script. The exact configuration of the system determines its vulnerability to this attack.

Recommendations For Apache Sling Servlets Resolver versions prior to 2.11.0, upgrade to version 2.11.0 to fix the issue. It is recommended to upgrade regardless of the current system configuration to prevent potential exploitation.