CVE-2022-45064 json
Apache Sling Engine: Include-based XSS
published 2023-04-13 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-1351 , GHSA-mg46-f9h5-g27x
- cvss
- 8.0
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.1%
- EPSS 1.1% chance of exploitation in 30 days, percentile 66%
- public exploits
- 0
- none known
Summary
The SlingRequestDispatcher doesn't correctly implement the RequestDispatcher API resulting in a generic type of include-based cross-site scripting issues on the Apache Sling level. The vulnerability is exploitable by an attacker that is able to include a resource with specific content-type and control the include path (i.e. writing content). The impact of a successful attack is privilege escalation to administrative power.
Please update to Apache Sling Engine >= 2.14.0 and enable the "Check Content-Type overrides" configuration option.
Patch / fix
- maven org.apache.sling:org.apache.sling.engine 2.14.0
- Apache Software Foundation Apache Sling Engine 2.14.0
- apache sling 2.14.0
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
1.12% chance of exploitation in the next 30 days, higher than 66% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.0 | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H |
| GitHub | 3.1 | 8.0 | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H |
| NVD | 3.1 | 9.0 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.sling:org.apache.sling.engine | <2.14.0 |
2.14.0 |
Affected products
- Apache Software Foundation Apache Sling Engine
- apache sling
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
lists.apache.org
/thread/hhp611hltby3whk03vx2mv7cmy3vs0ok
vendor-advisory, web, mailing-list
-
openwall.com
/lists/oss-security/2023/04/18/6
web, mailing-list
-
nvd.nist.gov
/vuln/detail/CVE-2022-45064
advisory
-
github.com
/apache/sling-org-apache-sling-engine
package
Sources
- CVE List CVE-2022-45064
- GitHub Advisory GHSA-mg46-f9h5-g27x
- NVD CVE-2022-45064
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Update CPE for accuracy.