CVE-2023-25141: Command Injection in Apache Sling

org.apache.sling:org.apache.sling.jcr.base Updated 02 Oct 2025

Summary

14/02/2023

Disclosed on

CVE-2023-25141

CVE

Yes i

Fix available

High

Severity

7.5

CVSS Score

CVE-2023-25141: Command injection in Apache Sling. Affects org.apache.sling:org.apache.sling.jcr.base versions < 3.1.12. Fixed in 3.1.12. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

Apache Sling is a web framework that allows developers to create content-oriented applications. The Apache Sling JCR Base package provides a foundation for accessing and manipulating content stored in a Java Content Repository (JCR). This vulnerability affects versions of Apache Sling JCR Base prior to 3.1.12, specifically when running on older JDK versions (JDK 1.8.191 or earlier).

Vulnerability Detail

The vulnerability in Apache Sling JCR Base arises from a critical injection flaw in the RepositoryAccessor utility functions. The functions getRepository and getRepositoryFromURL enable applications to access data stored in a remote location via JDNI and RMI. This vulnerability can be exploited by an attacker to execute arbitrary commands on the target system. It is important to note that this vulnerability is only present when using older JDK versions. Users of Apache Sling JCR Base are advised to upgrade to version 3.1.12 or later, or to use a more recent JDK.

How To Fix

Minimum fixed version

3.1.12

This is the first release that contains the fix.

Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →

Workaround

There is no known workaround for this vulnerability. It is crucial to upgrade to the fixed version of Apache Sling JCR Base and use a more recent JDK.

Conclusion

The command injection vulnerability in Apache Sling JCR Base poses a significant risk to systems running on older JDK versions. Users are strongly advised to upgrade to Apache Sling JCR Base 3.1.12 or later and consider using a more recent JDK version to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for org.apache.sling:org.apache.sling.jcr.base →