Malicious Code Execution via Path Traversal in Apache Sling Servlets Resolver

CVE-2024-23673

Summary

A vulnerability has been identified in the Apache Sling Servlets Resolver that allows for malicious code execution through path traversal. This issue affects all versions prior to 2.11.0. The degree of vulnerability is contingent on the specific configuration of the system. If exploited, users with write access to the repository could manipulate the Sling Servlet Resolver into executing a script that has been previously uploaded. It is advisable to upgrade to version 2.11.0 to mitigate this risk effectively, regardless of current system configuration.

References