GHSA-qmx3-m648-hr74

Source

https://github.com/advisories/GHSA-qmx3-m648-hr74

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/06/GHSA-qmx3-m648-hr74/GHSA-qmx3-m648-hr74.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-qmx3-m648-hr74

Aliases

CVE-2022-32549

Published

2022-06-23T00:00:34Z

Modified

2023-11-01T04:59:08.050712Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator

Summary

Log Injection in Apache Sling Commons Log and Apache Sling API

Details

Apache Sling Commons Log <= 5.4.0 and Apache Sling API <= 2.25.0 are vulnerable to log injection. The ability to forge logs may allow an attacker to cover tracks by injecting fake logs and potentially corrupt log files.

Database specific

{
    "cwe_ids": [
        "CWE-116",
        "CWE-117"
    ],
    "github_reviewed_at": "2022-06-23T17:48:50Z",
    "github_reviewed": true,
    "nvd_published_at": "2022-06-22T15:15:00Z",
    "severity": "MODERATE"
}

References

Affected packages

Maven / org.apache.sling:org.apache.sling.commons.log

Package

Name: org.apache.sling:org.apache.sling.commons.log; View open source insights on deps.dev
Purl: pkg:maven/org.apache.sling/org.apache.sling.commons.log

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Last affected

5.4.0

Affected versions

2.*

2.0.2-incubator

2.0.4-incubator

2.0.6

2.1.0

2.1.2

3.*

3.0.0

3.0.2

4.*

4.0.0

4.0.2

4.0.4

4.0.6

5.*

5.0.0

5.0.2

5.1.0

5.1.2

5.1.4

5.1.6

5.1.8

5.1.10

5.1.12

5.1.14

5.2.0

5.3.0

5.4.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/06/GHSA-qmx3-m648-hr74/GHSA-qmx3-m648-hr74.json"

Maven / org.apache.sling:org.apache.sling.api

Package

Name: org.apache.sling:org.apache.sling.api; View open source insights on deps.dev
Purl: pkg:maven/org.apache.sling/org.apache.sling.api

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Last affected

2.25.0

Affected versions

2.*

2.0.2-incubator

2.0.4-incubator

2.0.6

2.0.8

2.1.0

2.2.0

2.2.2

2.2.4

2.3.0

2.4.0

2.4.2

2.5.0

2.6.0

2.7.0

2.8.0

2.9.0

2.11.0

2.12.0

2.14.0

2.14.2

2.15.0

2.16.0

2.16.2

2.16.4

2.18.0

2.18.2

2.18.4

2.20.0

2.21.0

2.22.0

2.23.0

2.23.4

2.23.6

2.24.0

2.25.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/06/GHSA-qmx3-m648-hr74/GHSA-qmx3-m648-hr74.json"