What is GHSA-qmx3-m648-hr74?

GHSA-qmx3-m648-hr74 is a security advisory published by GitHub Security Advisories with Medium severity. Log Injection in Apache Sling Commons Log and Apache Sling API

Which CVE IDs does GHSA-qmx3-m648-hr74 cover?

GHSA-qmx3-m648-hr74 covers the following CVE IDs: CVE-2022-32549. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-qmx3-m648-hr74?

GHSA-qmx3-m648-hr74 has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

Which products are affected by GHSA-qmx3-m648-hr74?

GHSA-qmx3-m648-hr74 affects 2 products, including: maven/org.apache.sling:org.apache.sling.commons.log:\u003c= 5.4.0; maven/org.apache.sling:org.apache.sling.api:\u003c= 2.25.0.

GHSA-qmx3-m648-hr74MediumCVSS 5.3

Log Injection in Apache Sling Commons Log and Apache Sling API

Vendor

GitHub Security Advisories

Published

June 23, 2022

Last Modified

January 27, 2023

🔗 CVE IDs covered (1)

CVE-2022-32549 →

📋 Description

Apache Sling Commons Log <= 5.4.0 and Apache Sling API <= 2.25.0 are vulnerable to log injection. The ability to forge logs may allow an attacker to cover tracks by injecting fake logs and potentially corrupt log files.

🎯 Affected products2

maven/org.apache.sling:org.apache.sling.commons.log:<= 5.4.0
maven/org.apache.sling:org.apache.sling.api:<= 2.25.0

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2022-32549
https://lists.apache.org/thread/7z6h3806mwcov5kx6l96pq839sn0po1v
https://github.com/advisories/GHSA-qmx3-m648-hr74