GHSA-wjp3-4xcq-598p

    Dashboard / Vulnerabilities / GHSA-wjp3-4xcq-598p

    GHSA-wjp3-4xcq-598p

    Published: 14 May 2022Last Modified: 16 Feb 2024
    Aliases:
    CVE-2012-3353

    Summary: Apache Sling JCR ContentLoader XmlReader Arbitrary File Load

    Details: The Apache Sling JCR ContentLoader 2.1.4 XmlReader used in the Sling JCR content loader module makes it possible to import arbitrary files in the content repository, including local files, causing potential information leaks. Users should upgrade to version 2.1.6 of the JCR ContentLoader

    References: https://nvd.nist.gov/vuln/detail/CVE-2012-3353, https://issues.apache.org/jira/browse/SLING-2512, https://lists.apache.org/thread/owd2xw86l19dh1f1zlhq41l7wlnd16sk

    Affected packages

    Package

    Name: org.apache.sling:org.apache.sling.jcr.contentloader

    Purl: pkg:maven/org.apache.sling/org.apache.sling.jcr.contentloader

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -2.1.6

    Affected versions

    2.0.2-incubator
    2.0.4-incubator
    2.0.6

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-wjp3-4xcq-598p | CVE-DB