CVE-2022-32549: log injection in Sling logging
Apache Sling Commons Log <= 5.4.0 and Apache Sling API <= 2.25.0 are vulnerable to log injection. The ability to forge logs may allow an attacker to cover tracks by injecting fake logs and potentially corrupt log files.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-32549?
CVE-2022-32549 is classified as a high severity vulnerability due to its potential to allow attackers to forge logs and cover their tracks.
How do I fix CVE-2022-32549?
To fix CVE-2022-32549, upgrade Apache Sling API to version 2.26.0 or later and Apache Sling Commons Log to version 5.4.1 or later.
What types of attacks can CVE-2022-32549 facilitate?
CVE-2022-32549 can facilitate log injection attacks, potentially allowing attackers to insert fake logs into log files.
Which versions of Apache Sling are affected by CVE-2022-32549?
CVE-2022-32549 affects Apache Sling Commons Log versions up to 5.4.0 and Apache Sling API versions up to 2.25.0.
Is log integrity affected by CVE-2022-32549?
Yes, CVE-2022-32549 compromises log integrity, as attackers can inject falsified logs that may corrupt log files.