CVE-2024-23673

Malicious code execution via path traversal in Apache Software Foundation Apache Sling Servlets Resolver.This issue affects all version of Apache Sling Servlets Resolver before 2.11.0. However, whether a system is vulnerable to this attack depends on the exact configuration of the system. If the system is vulnerable, a user with write access to the repository might be able to trick the Sling Servlet Resolver to load a previously uploaded script. Users are recommended to upgrade to version 2.11.0, which fixes this issue. It is recommended to upgrade, regardless of whether your system configuration currently allows this attack or not.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.6 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
http://www.openwall.com/lists/oss-security/2024/02/06/1	Mailing List
https://lists.apache.org/thread/5zzx8ztwc6tmbwlw80m2pbrp3913l2kl	Mailing List

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:sling_servlets_resolver:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2024-02-06 10:15

Updated : 2024-02-14 00:26

NVD link : CVE-2024-23673

Mitre link : CVE-2024-23673

CVE.ORG link : CVE-2024-23673

JSON object : View

Products Affected

apache

sling_servlets_resolver

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2024-23673", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.6}, {"type": "Secondary", "source": "security@apache.org", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.8}]}, "published": "2024-02-06T10:15:08.833", "references": [{"url": "http://www.openwall.com/lists/oss-security/2024/02/06/1", "tags": ["Mailing List"], "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread/5zzx8ztwc6tmbwlw80m2pbrp3913l2kl", "tags": ["Mailing List"], "source": "security@apache.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "\nMalicious code execution via path traversal in Apache Software Foundation Apache Sling Servlets Resolver.This issue affects all version of Apache Sling Servlets Resolver before 2.11.0. However, whether a system is vulnerable to this attack depends on the exact configuration of the system.\nIf the system is vulnerable, a user with write access to the repository might be able to trick the Sling Servlet Resolver to load a previously uploaded script.\u00a0\n\nUsers are recommended to upgrade to version 2.11.0, which fixes this issue. It is recommended to upgrade, regardless of whether your system configuration currently allows this attack or not."}, {"lang": "es", "value": "Ejecuci\u00f3n de c\u00f3digo malicioso mediante path traversal en Apache Software Foundation Apache Sling Servlets Resolver. Este problema afecta a todas las versiones de Apache Sling Servlets Resolver anteriores a la 2.11.0. Sin embargo, si un sistema es vulnerable a este ataque depende de la configuraci\u00f3n exacta del sistema. Si el sistema es vulnerable, un usuario con acceso de escritura al repositorio podr\u00eda enga\u00f1ar a Sling Servlet Resolver para que cargue un script cargado previamente. Se recomienda a los usuarios actualizar a la versi\u00f3n 2.11.0, que soluciona este problema. Se recomienda actualizar, independientemente de si la configuraci\u00f3n de su sistema actualmente permite este ataque o no."}], "lastModified": "2024-02-14T00:26:41.517", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:sling_servlets_resolver:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8C704B34-F87E-470B-B9DF-9F7B69F8FC7A", "versionEndExcluding": "2.11.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}