CVE-2024-23673 json
Apache Sling Servlets Resolver: Malicious code execution via path traversal
published 2024-02-06 2 y ago modified 2026-06-17 4 mo ago also GHSA-h2rq-qhr7-53gm , EUVD-2024-0646
- cvss
- 8.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.3%
- EPSS 1.3% chance of exploitation in 30 days, percentile 71%
- public exploits
- 0
- none known
Summary
Malicious code execution via path traversal in Apache Software Foundation Apache Sling Servlets Resolver.This issue affects all version of Apache Sling Servlets Resolver before 2.11.0. However, whether a system is vulnerable to this attack depends on the exact configuration of the system. If the system is vulnerable, a user with write access to the repository might be able to trick the Sling Servlet Resolver to load a previously uploaded script.
Users are recommended to upgrade to version 2.11.0, which fixes this issue. It is recommended to upgrade, regardless of whether your system configuration currently allows this attack or not.
Patch / fix
- maven org.apache.sling:org.apache.sling.servlets.resolver 2.11.0
- Apache Software Foundation Apache Sling Servlets Resolver 2.11.0
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- total
- Assessed
- 18 mo ago
Exploit prediction
1.32% chance of exploitation in the next 30 days, higher than 71% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.5 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.sling:org.apache.sling.servlets.resolver | <2.11.0 |
2.11.0 |
Affected products
- Apache Software Foundation Apache Sling Servlets Resolver
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
-
github.com
/apache/sling-org-apache-sling-servlets-resolver/commit/b54d4e6693e0bcd63a97a0328f4f065b8a81b75e
web
-
lists.apache.org
/thread/5zzx8ztwc6tmbwlw80m2pbrp3913l2kl
vendor-advisory, web, mailing-list
-
openwall.com
/lists/oss-security/2024/02/06/1
web, mailing-list
-
nvd.nist.gov
/vuln/detail/CVE-2024-23673
advisory
-
github.com
/apache/sling-org-apache-sling-servlets-resolver
package
Sources
- CVE List CVE-2024-23673
- GitHub Advisory GHSA-h2rq-qhr7-53gm
- NVD CVE-2024-23673
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.