CVE-2022-32549CWE-117

CVE-2022-32549: vulnerability in Apache Sling

log injection in Sling logging

Published · Updated

Follow this CVE+ Monitor Apache Sling+ Monitor org.apache.sling:org.apache.sling.api

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 2.4%
Apache Sling Commons Log <= 5.4.0 and Apache Sling API <= 2.25.0 are vulnerable to log injection. The ability to forge logs may allow an attacker to cover tracks by injecting fake logs and potentially corrupt log files.
Affected products
Apache Software Foundation · Apache Sling
Related CVEs — Apache Sling

In the same product, most dangerous first.

CVE-2016-6798—CVE-2016-6798EPSS 3.7%CVE-2012-3353—CVE-2012-3353EPSS 3.1%CVE-2017-15717—CVE-2017-15717EPSS 2.9%CVE-2016-5394—CVE-2016-5394EPSS 2.6%CVE-2017-15700—CVE-2017-15700EPSS 1.9%CVE-2023-25621MEDIUMApache Sling does not allow to handle i18n content in a secure wayEPSS 1.1%