GitHub Advisoryadvisory · Maven

GHSA-wjp3-4xcq-598p Apache Sling JCR ContentLoader XmlReader Arbitrary File Load

HIGH Published 2022-05-14 Modified 2023-08-29 Official page ↗
Aliases
CVE-2012-3353
Ecosystem
Maven
Packages
org.apache.sling:org.apache.sling.jcr.contentloader
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200
Reviewed
2023-08-29

Affected packages

• Maven org.apache.sling:org.apache.sling.jcr.contentloader: < 2.1.6 → fixed in 2.1.6

Description

The Apache Sling JCR ContentLoader 2.1.4 XmlReader used in the Sling JCR content loader module makes it possible to import arbitrary files in the content repository, including local files, causing potential information leaks. Users should upgrade to version 2.1.6 of the JCR ContentLoader

Related

Alias · CVE (1)

  • CVE-2012-3353 The Apache Sling JCR ContentLoader 2.1.4 XmlReader used in the Sling JCR content loader module makes it possible to import arbitrary files… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References