Malicious Code Execution via Path Traversal in Apache Sling Servlets Resolver
CVE-2024-23673
8.5HIGH
Key Information:
- Vendor
Apache
- Vendor
- CVE Published:
- 6 February 2024
What is CVE-2024-23673?
A vulnerability has been identified in the Apache Sling Servlets Resolver that allows for malicious code execution through path traversal. This issue affects all versions prior to 2.11.0. The degree of vulnerability is contingent on the specific configuration of the system. If exploited, users with write access to the repository could manipulate the Sling Servlet Resolver into executing a script that has been previously uploaded. It is advisable to upgrade to version 2.11.0 to mitigate this risk effectively, regardless of current system configuration.
Affected Version(s)
Apache Sling Servlets Resolver 0 < 2.11.0