Log Manipulation Affecting org.apache.sling:org.apache.sling.commons.log package, versions [0,5.4.2)
Snyk CVSS
Attack Complexity
Low
Threat Intelligence
EPSS
0.22% (60th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGAPACHESLING-2934397
- published 23 Jun 2022
- disclosed 23 Jun 2022
- credit Alex Collignon
Introduced: 23 Jun 2022
CVE-2022-32549 Open this link in a new tabHow to fix?
Upgrade org.apache.sling:org.apache.sling.commons.log
to version 5.4.2 or higher.
Overview
org.apache.sling:org.apache.sling.commons.log is an Apache Sling Commons Log packages the Logback library to manage logging in an OSGi environment
Affected versions of this package are vulnerable to Log Manipulation when an attacker injects falsified log lines.