CVE-2023-25621 json
Apache Sling does not allow to handle i18n content in a secure way
published 2023-02-23 3 y ago modified 2026-06-17 4 mo ago also GHSA-mrpv-5pmr-p92h , EUVD-2023-0741
- cvss
- 6.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.1%
- EPSS 1.1% chance of exploitation in 30 days, percentile 67%
- public exploits
- 0
- none known
Summary
Privilege Escalation vulnerability in Apache Software Foundation Apache Sling. Any content author is able to create i18n dictionaries in the repository in a location the author has write access to. As these translations are used across the whole product, it allows an author to change any text or dialog in the product. For example an attacker might fool someone by changing the text on a delete button to "Info". This issue affects the i18n module of Apache Sling up to version 2.5.18. Version 2.6.2 and higher limit by default i18m dictionaries to certain paths in the repository (/libs and /apps).
Users of the module are advised to update to version 2.6.2 or higher, check the configuration for resource loading and then adjust the access permissions for the configured path accordingly.
Patch / fix
- maven org.apache.sling:org.apache.sling.i18n 2.6.2
- apache sling_i18n 2.6.2
- github.com/apache/sling-org-apache-sling-i18n#9 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 19 mo ago
Exploit prediction
1.15% chance of exploitation in the next 30 days, higher than 67% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
| NVD | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
| CNA | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
| GitHub | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.sling:org.apache.sling.i18n | <2.6.2 |
2.6.2 |
Affected products
- Apache Software Foundation Apache Sling
Classification
- Weakness
-
- CWE-269 Improper Privilege Management
References
-
github.com
/apache/sling-org-apache-sling-i18n/pull/9
web
-
sling.apache.org
/news.html
vendor-advisory, web, product
-
nvd.nist.gov
/vuln/detail/CVE-2023-25621
advisory
-
issues.apache.org
/jira/browse/SLING-11744
web
-
seclists.org
/oss-sec/2023/q1/112
web
Sources
- CVE List CVE-2023-25621
- GitHub Advisory GHSA-mrpv-5pmr-p92h
- NVD CVE-2023-25621
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.