Apache Sling API vulnerabilities

2 CVEs affecting Apache Sling API, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-32549, published 2022-06-22.

More from Apache.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2015-2944, published 2015-06-02. Medium severity, CVSS 4.3. EPSS: 6.3% chance of exploitation in the next 30 days. Multiple cross-site scripting (XSS) vulnerabilities in Apache Sling API before 2.2.2 and Apache Sling Servlets Post before 2.1.2 allow remote attackers to inject arbitrary web script or HTML via the…
• CVE-2022-32549, published 2022-06-22. Medium severity, CVSS 5.3. EPSS: 2.4% chance of exploitation in the next 30 days. Apache Sling Commons Log <= 5.4.0 and Apache Sling API <= 2.25.0 are vulnerable to log injection. The ability to forge logs may allow an attacker to cover tracks by injecting fake logs and…