CVE-2013-2254 Improper Restriction of Operations within the Bounds of a Memory Buffer in Apache Sling
Remote attackers can cause a denial of service via infinite loop in Apache Sling servlets post bundle when handling null permissions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2013-2254?
CVE-2013-2254 is a medium-severity denial of service vulnerability in n/a, published on 17 Oct 2013. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The deepGetOrCreateNode function in impl/operations/AbstractCreateOperation.java in org.apache.sling.servlets.post.bundle 2.2.0 and 2.3.0 in Apache Sling does not properly handle a NULL value that returned when the session does not have permissions to the root node, which allows remote attackers to cause a denial of service (infinite loop) via unspecified vectors.
Weakness: CWE-119
Which versions are affected by CVE-2013-2254?
2 open source packages ship an affected version, including org.apache.sling:org.apache.sling.api. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.sling:org.apache.sling.api Maven | All versions | 2.4.0 |
org.apache.sling:org.apache.sling.api Maven | All versions | 2.4.0 |
Products include Apache Org.apache.sling.servlets.post.
How do I fix CVE-2013-2254?
Upgrade org.apache.sling:org.apache.sling.api to 2.4.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2013-2254 being exploited?
There is no known exploitation of CVE-2013-2254 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-cxwh-vmhg-39r2.