CVE-2023-25141

Apache Sling JCR Base 3.1.12 has a critical injection vulnerability when running on old JDK versions JDK 1.8.191 or earlier through utility functions in RepositoryAccessor. The functions getRepository and getRepositoryFromURL allow an application to access data stored in a remote location via JDN...

biz.netcentric.cq.tools.accesscontroltool:maximum-environment (>=2.5.4 <=3.6.2), biz.netcentric.cq.tools.accesscontroltool:minimum-environment (>=2.5.4 <=3.6.2) +38 more potentially affected by CVE-2023-25141 via org.apache.sling:org.apache.sling.jcr.base (>=2.0.2-incubator <=3.1.10)

org.apache.sling:org.apache.sling.jcr.base MAVEN version =2.0.2-incubator, =2.5.4, =2.5.4, =4.2.0, =0.6.8, =2.1.1, =2.5.0, =2.1.1, =2.5.0, =1.7.0, =1.3.1, =1.6.0, =5.5.4, =1.4.0-0001, =1.0.3, =1.0.3, =1.0.5 and more Source cves: CVE-2023-25141 Source advisory:...

CVE-2023-25141 JNDI injection into Apache sling-org-apache-sling-jcr-base

Apache Sling JCR Base 3.1.12 has a critical injection vulnerability when running on old JDK versions JDK 1.8.191 or earlier through utility functions in RepositoryAccessor. The functions getRepository and getRepositoryFromURL allow an application to access data stored in a remote location via JDN...

CVE-2023-25141

CVE-2023-25141 concerns Apache Sling JCR Base versions prior to 3.1.12. The issue is a critical injection vulnerability in RepositoryAccessor functions getRepository and getRepositoryFromURL, which allow a remote attacker to access data via JNDI and RMI when running on older JDKs (1.8.191 or earl...