cnvd - cnvd-2018-03247

cnvd-2018-03247

Vulnerability from cnvd

Title: Apache Sling JCR ContentLoader XmlReader存在未明漏洞

Description:

Apache Sling JCR ContentLoader是美国阿帕奇（Apache）软件基金会的一套用于Java平台上的开源Web框架。该框架可在JCR内容库（Java Content Repository）上创建面向内容的应用。XmlReader是其中的一个XML文档阅读工具。

Apache Sling JCR ContentLoader中XmlReader存在安全漏洞。攻击者可利用该漏洞导出内容库中的任意文件（包括本地文件）。

Severity: 中

Patch Name: Apache Sling JCR ContentLoader XmlReader存在未明漏洞的补丁

Patch Description:

Apache Sling JCR ContentLoader中XmlReader存在安全漏洞。攻击者可利用该漏洞导出内容库中的任意文件（包括本地文件）。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://issues.apache.org/jira/browse/SLING-2512

Reference: https://lists.apache.org/thread.html/50994d80dd5cf93f1365dacfcaecf5c12f1efe522c4ff6040b3c521a@%3Cdev.sling.apache.org%3E

Impacted products

Name
Apache Sling JCR ContentLoade 2.1.4

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2012-3353"
    }
  },
  "description": "Apache Sling JCR ContentLoader\u662f\u7f8e\u56fd\u963f\u5e15\u5947\uff08Apache\uff09\u8f6f\u4ef6\u57fa\u91d1\u4f1a\u7684\u4e00\u5957\u7528\u4e8eJava\u5e73\u53f0\u4e0a\u7684\u5f00\u6e90Web\u6846\u67b6\u3002\u8be5\u6846\u67b6\u53ef\u5728JCR\u5185\u5bb9\u5e93\uff08Java Content Repository\uff09\u4e0a\u521b\u5efa\u9762\u5411\u5185\u5bb9\u7684\u5e94\u7528\u3002XmlReader\u662f\u5176\u4e2d\u7684\u4e00\u4e2aXML\u6587\u6863\u9605\u8bfb\u5de5\u5177\u3002\r\n\r\nApache Sling JCR ContentLoader\u4e2dXmlReader\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u51fa\u5185\u5bb9\u5e93\u4e2d\u7684\u4efb\u610f\u6587\u4ef6\uff08\u5305\u62ec\u672c\u5730\u6587\u4ef6\uff09\u3002",
  "discovererName": "Apache",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://issues.apache.org/jira/browse/SLING-2512",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2018-03247",
  "openTime": "2018-02-12",
  "patchDescription": "Apache Sling JCR ContentLoader\u662f\u7f8e\u56fd\u963f\u5e15\u5947\uff08Apache\uff09\u8f6f\u4ef6\u57fa\u91d1\u4f1a\u7684\u4e00\u5957\u7528\u4e8eJava\u5e73\u53f0\u4e0a\u7684\u5f00\u6e90Web\u6846\u67b6\u3002\u8be5\u6846\u67b6\u53ef\u5728JCR\u5185\u5bb9\u5e93\uff08Java Content Repository\uff09\u4e0a\u521b\u5efa\u9762\u5411\u5185\u5bb9\u7684\u5e94\u7528\u3002XmlReader\u662f\u5176\u4e2d\u7684\u4e00\u4e2aXML\u6587\u6863\u9605\u8bfb\u5de5\u5177\u3002\r\n\r\nApache Sling JCR ContentLoader\u4e2dXmlReader\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u51fa\u5185\u5bb9\u5e93\u4e2d\u7684\u4efb\u610f\u6587\u4ef6\uff08\u5305\u62ec\u672c\u5730\u6587\u4ef6\uff09\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Apache Sling JCR ContentLoader XmlReader\u5b58\u5728\u672a\u660e\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "Apache Sling JCR ContentLoade 2.1.4"
  },
  "referenceLink": "https://lists.apache.org/thread.html/50994d80dd5cf93f1365dacfcaecf5c12f1efe522c4ff6040b3c521a@%3Cdev.sling.apache.org%3E",
  "serverity": "\u4e2d",
  "submitTime": "2018-01-11",
  "title": "Apache Sling JCR ContentLoader XmlReader\u5b58\u5728\u672a\u660e\u6f0f\u6d1e"
}

CVE-2012-3353 (GCVE-0-2012-3353)

Vulnerability from cvelistv5

Published

2018-01-08 21:00

Modified

2024-09-16 23:56

Severity ?

CWE

Content Loading Vulnerability

Summary

The Apache Sling JCR ContentLoader 2.1.4 XmlReader used in the Sling JCR content loader module makes it possible to import arbitrary files in the content repository, including local files, causing potential information leaks. Users should upgrade to version 2.1.6 of the JCR ContentLoader

References

▼	URL	Tags
	https://lists.apache.org/thread.html/50994d80dd5cf93f1365dacfcaecf5c12f1efe522c4ff6040b3c521a%40%3Cdev.sling.apache.org%3E	mailing-list, x_refsource_MLIST
	https://issues.apache.org/jira/browse/SLING-2512	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	Apache Software Foundation	Apache Sling	Version: JCR ContentLoader 2.1.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T20:05:11.885Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[dev] 20180108 CVE-2012-3353: Apache Sling Content Loading Vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/50994d80dd5cf93f1365dacfcaecf5c12f1efe522c4ff6040b3c521a%40%3Cdev.sling.apache.org%3E"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://issues.apache.org/jira/browse/SLING-2512"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Apache Sling",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "status": "affected",
              "version": "JCR ContentLoader 2.1.4"
            }
          ]
        }
      ],
      "datePublic": "2017-05-09T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The Apache Sling JCR ContentLoader 2.1.4 XmlReader used in the Sling JCR content loader module makes it possible to import arbitrary files in the content repository, including local files, causing potential information leaks. Users should upgrade to version 2.1.6 of the JCR ContentLoader"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Content Loading Vulnerability",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-01-08T20:57:01",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "name": "[dev] 20180108 CVE-2012-3353: Apache Sling Content Loading Vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/50994d80dd5cf93f1365dacfcaecf5c12f1efe522c4ff6040b3c521a%40%3Cdev.sling.apache.org%3E"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://issues.apache.org/jira/browse/SLING-2512"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@apache.org",
          "DATE_PUBLIC": "2017-05-09T00:00:00",
          "ID": "CVE-2012-3353",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Apache Sling",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "JCR ContentLoader 2.1.4"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Apache Software Foundation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Apache Sling JCR ContentLoader 2.1.4 XmlReader used in the Sling JCR content loader module makes it possible to import arbitrary files in the content repository, including local files, causing potential information leaks. Users should upgrade to version 2.1.6 of the JCR ContentLoader"
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Content Loading Vulnerability"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "[dev] 20180108 CVE-2012-3353: Apache Sling Content Loading Vulnerability",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/50994d80dd5cf93f1365dacfcaecf5c12f1efe522c4ff6040b3c521a@%3Cdev.sling.apache.org%3E"
            },
            {
              "name": "https://issues.apache.org/jira/browse/SLING-2512",
              "refsource": "CONFIRM",
              "url": "https://issues.apache.org/jira/browse/SLING-2512"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2012-3353",
    "datePublished": "2018-01-08T21:00:00Z",
    "dateReserved": "2012-06-14T00:00:00",
    "dateUpdated": "2024-09-16T23:56:19.347Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted