CVE-2022-32549 log injection in Sling logging
Attackers can inject fake entries into Apache Sling logs to corrupt files and hide malicious activity, requiring an upgrade to patched versions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-32549?
CVE-2022-32549 is a medium-severity vulnerability in Apache Sling, published on 22 Jun 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Apache Sling Commons Log <= 5.4.0 and Apache Sling API <= 2.25.0 are vulnerable to log injection. The ability to forge logs may allow an attacker to cover tracks by injecting fake logs and potentially corrupt log files.
Which versions are affected by CVE-2022-32549?
4 open source packages ship an affected version, including org.apache.sling:org.apache.sling.api and org.apache.sling:org.apache.sling.commons.log. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.sling:org.apache.sling.api Maven | All versions to 2.25.0 | None |
org.apache.sling:org.apache.sling.api Maven | All versions to 2.25.0 | None |
org.apache.sling:org.apache.sling.commons.log Maven | All versions to 5.4.0 | None |
org.apache.sling:org.apache.sling.commons.log Maven | All versions to 5.4.0 | None |
Products include Apache Sling Api, Apache Sling Commons Log.
How do I fix CVE-2022-32549?
No fix has been published for CVE-2022-32549 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-32549 being exploited?
There is no known exploitation of CVE-2022-32549 in the wild and no public exploit code.
Other vulnerabilities in Apache Sling
Sources
Also known as GHSA-qmx3-m648-hr74.