Description
Apache Sling Commons Log <= 5.4.0 and Apache Sling API <= 2.25.0 are vulnerable to log injection. The ability to forge logs may allow an attacker to cover tracks by injecting fake logs and potentially corrupt log files.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Sling | Apache Sling API – ≤ 2.25.0, Apache Sling Commons Log – ≤ 5.4.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.sling:org.apache.sling.api | <= 2.25.0 | — | GHSA-qmx3-m648-hr74 |
| Maven | org.apache.sling:org.apache.sling.commons.log | <= 5.4.0 | — | GHSA-qmx3-m648-hr74 |