Malicious Code Execution via Path Traversal in Apache Sling Servlets Resolver
CVE-2024-23673

8.5HIGH

Key Information:

Vendor

Apache
Status
Apache Sling Servlets Resolver
Vendor
CVE Published:
6 February 2024

What is CVE-2024-23673?

A vulnerability has been identified in the Apache Sling Servlets Resolver that allows for malicious code execution through path traversal. This issue affects all versions prior to 2.11.0. The degree of vulnerability is contingent on the specific configuration of the system. If exploited, users with write access to the repository could manipulate the Sling Servlet Resolver into executing a script that has been previously uploaded. It is advisable to upgrade to version 2.11.0 to mitigate this risk effectively, regardless of current system configuration.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Apache Sling Servlets Resolver 0 < 2.11.0

References

https://lists.apache.org/thread/5zzx8ztwc6tmbwlw80m2pbrp3...
vendor-advisory
http://www.openwall.com/lists/oss-security/2024/02/06/1

CVSS V3.1

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.