biz.netcentric.cq.tools.accesscontroltool:accesscontroltool-bundle (>=1.2.8, <=2.0.6), ch.liip.aem:pretty-jsp (>=0.1.1, <=0.1.2) +251 more potentially affected by CVE-2013-2254 via org.apache.sling:org.apache.sling.api (>=2.0.2-incubator, <=2.3.0)

org.apache.sling:org.apache.sling.api MAVEN version =2.0.2-incubator, =1.2.8, =0.1.1, =2.4.0, =5.6.0, =5.5.0, =5.6.2, =5.6.2, =5.6.6, =5.6.14, =2.0.6, =2.0.58 and more Source cves: CVE-2013-2254 Source advisory: OSV:GHSA-CXWH-VMHG-39R2...

biz.netcentric.cq.tools.accesscontroltool:accesscontroltool-bundle (>=1.2.8, <=2.0.6), ch.liip.aem:pretty-jsp (>=0.1.1, <=0.1.2) +251 more potentially affected by CVE-2013-2254 via org.apache.sling:org.apache.sling.api (>=2.0.2-incubator, <=2.3.0)

org.apache.sling:org.apache.sling.api MAVEN version =2.0.2-incubator, =1.2.8, =0.1.1, =2.4.0, =5.6.0, =5.5.0, =5.6.2, =5.6.2, =5.6.6, =5.6.14, =2.0.6, =2.0.58 and more Source cves: CVE-2013-2254 Source advisory: MEND:CVE-2013-2254...

CVE-2013-2254

CVE-2013-2254 affects Apache Sling’s org.apache.sling.servlets.post.bundle in deepGetOrCreateNode (AbstractCreateOperation.java). The root cause is improper handling of a NULL value when the session lacks permissions to the root node, enabling remote denial of service via an infinite loop in Slin...