CVE-2023-25621

2023-02-2309:15:10

[email protected]

web.nvd.nist.gov

cve-2023-25621

privilege escalation

apache sling

i18n module

security vulnerability

apache software foundation

update

access permissions

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

0.001 Low

EPSS

Percentile

23.1%

JSON

Privilege Escalation vulnerability in Apache Software Foundation Apache Sling.
Any content author is able to create i18n dictionaries in the repository in a location the author has write access to. As these translations are used across the whole product, it allows an author to change any text or dialog in the product. For example an attacker might fool someone by changing the text on a delete button to “Info”.
This issue affects the i18n module of Apache Sling up to version 2.5.18. Version 2.6.2 and higher limit by default i18m dictionaries to certain paths in the repository (/libs and /apps).

Users of the module are advised to update to version 2.6.2 or higher, check the configuration for resource loading and then adjust the access permissions for the configured path accordingly.

Affected configurations

Vulners

NVD

Node

apacheslingRange≤2.5.18

CPENameOperatorVersion
apache:sling_i18napache sling i18nlt2.6.2

CPE	Name	Operator	Version
apache:sling_i18n	apache sling i18n	lt	2.6.2

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache Sling",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "2.5.18",
        "status": "affected",
        "version": "Apache Sling i18n",
        "versionType": "maven"
      }
    ]
  }
]