CVE-2023-25141 json
JNDI injection into Apache sling-org-apache-sling-jcr-base
published 2023-02-14 3 y ago modified 2026-06-17 4 mo ago also GHSA-gvg3-83q4-rfhq , EUVD-2023-0711
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.2%
- EPSS 1.2% chance of exploitation in 30 days, percentile 67%
- public exploits
- 0
- none known
Summary
Apache Sling JCR Base < 3.1.12 has a critical injection vulnerability when running on old JDK versions (JDK 1.8.191 or earlier) through utility functions in RepositoryAccessor. The functions getRepository and getRepositoryFromURL allow an application to access data stored in a remote location via JDNI and RMI.
Users of Apache Sling JCR Base are recommended to upgrade to Apache Sling JCR Base 3.1.12 or later, or to run on a more recent JDK.
Patch / fix
- maven org.apache.sling:org.apache.sling.jcr.base 3.1.12
- Apache Software Foundation Apache Sling JCR Base 3.1.12
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 19 mo ago
Exploit prediction
1.16% chance of exploitation in the next 30 days, higher than 67% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.sling:org.apache.sling.jcr.base | <3.1.12 |
3.1.12 |
Affected products
- Apache Software Foundation Apache Sling JCR Base
Classification
- Weakness
-
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component
References
-
github.com
/apache/sling-org-apache-sling-jcr-base/commit/6ed0a030fd5f13774aff0073c55cbe3ace0153cb
web
-
github.com
/apache/sling-org-apache-sling-jcr-base/commit/779d8a7dd0437a4f31de02c0d995afcf83b9904b
web
-
sling.apache.org
/news.html
vendor-advisory, web
-
nvd.nist.gov
/vuln/detail/CVE-2023-25141
advisory
-
github.com
/apache/sling-org-apache-sling-jcr-base
package
-
issues.apache.org
/jira/browse/SLING-11770
web
Sources
- CVE List CVE-2023-25141
- GitHub Advisory GHSA-gvg3-83q4-rfhq
- NVD CVE-2023-25141
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.