Read the docs
TI-2023-10604 Aliases CVE-2023-25141GHSA-gvg3-83q4-rfhq

JNDI injection into Apache sling-org-apache-sling-jcr-base

Priority MEDIUM 41CWE-74Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub.

Summary

Apache Sling JCR Base < 3.1.12 has a critical injection vulnerability when running on old JDK versions (JDK 1.8.191 or earlier) through utility functions in RepositoryAccessor. The functions getRepository and getRepositoryFromURL allow an application to access data stored in a remote location via JDNI and RMI. Users of Apache Sling JCR Base are recommended to upgrade to Apache Sling JCR Base 3.1.12 or later, or to run on a more recent JDK.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0116 67th percentileScored 2026-11-07
Fix Fixed Apache Sling JCR Base (Apache Software Foundation): 3.1.12org.apache.sling:org.apache.sling.jcr.base (Maven): 3.1.12

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Sling JCR Base2.0.6 to before 3.1.123.1.12Patch availableCNA
—org.apache.sling:org.apache.sling.jcr.base (Maven)before 3.1.123.1.12Patch availableGHSA-gvg3-83q4-rfhq
  • Apache Sling JCR Base VendorApache Affected 2.0.6 to before 3.1.12 Fixed in 3.1.12 Patch available CNA
  • org.apache.sling:org.apache.sling.jcr.base (Maven) Vendor— Affected before 3.1.12 Fixed in 3.1.12 Patch available GHSA-gvg3-83q4-rfhq

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:sling_jcr_base:*:*:*:*:*:*:*:*2.0.6 to before 3.1.12VulnerableApache
  • cpe:2.3:a:apache:sling_jcr_base:*:*:*:*:*:*:*:* Versions 2.0.6 to before 3.1.12 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache Sling JCR Base (Apache Software Foundation) Fixed in 3.1.12
  • Fix · GHSA-gvg3-83q4-rfhq org.apache.sling:org.apache.sling.jcr.base (Maven) Fixed in 3.1.12 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-25141
  2. 2026-10-03 Alias added: GHSA-gvg3-83q4-rfhq

References

Advisory 2

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences