What is GHSA-wjp3-4xcq-598p?

GHSA-wjp3-4xcq-598p is a security advisory published by GitHub Security Advisories with High severity. Apache Sling JCR ContentLoader XmlReader Arbitrary File Load

Which CVE IDs does GHSA-wjp3-4xcq-598p cover?

GHSA-wjp3-4xcq-598p covers the following CVE IDs: CVE-2012-3353. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-wjp3-4xcq-598p?

GHSA-wjp3-4xcq-598p has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-wjp3-4xcq-598p?

GHSA-wjp3-4xcq-598p affects 1 product, including: maven/org.apache.sling:org.apache.sling.jcr.contentloader:\u003c 2.1.6.

GHSA-wjp3-4xcq-598pHighCVSS 7.5

Apache Sling JCR ContentLoader XmlReader Arbitrary File Load

Vendor

GitHub Security Advisories

Published

May 14, 2022

Last Modified

August 29, 2023

🔗 CVE IDs covered (1)

CVE-2012-3353 →

📋 Description

The Apache Sling JCR ContentLoader 2.1.4 XmlReader used in the Sling JCR content loader module makes it possible to import arbitrary files in the content repository, including local files, causing potential information leaks. Users should upgrade to version 2.1.6 of the JCR ContentLoader

🎯 Affected products1

maven/org.apache.sling:org.apache.sling.jcr.contentloader:< 2.1.6

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2012-3353
https://issues.apache.org/jira/browse/SLING-2512
https://lists.apache.org/thread/owd2xw86l19dh1f1zlhq41l7wlnd16sk
https://github.com/advisories/GHSA-wjp3-4xcq-598p