medium5.3
CVE-2022-32549
Log Injection in Apache Sling Commons Log and Apache Sling API
Impact
Apache Sling Commons Log <= 5.4.0 and Apache Sling API <= 2.25.0 are vulnerable to log injection. The ability to forge logs may allow an attacker to cover tracks by injecting fake logs and potentially corrupt log files.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.apache.sling:org.apache.sling.commons.log | <= 5.4.0 | none recorded |
| maven | org.apache.sling:org.apache.sling.api | <= 2.25.0 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apache | Sling Api | through 2.25.0 |
| Apache | Sling Commons Log | through 5.4.0 |