{"cve":"CVE-2012-3353","nvd":{"published":"2018-01-09T02:29:02.613","modified":"2026-06-16T23:43:03.587","status":"Modified","description":"The Apache Sling JCR ContentLoader 2.1.4 XmlReader used in the Sling JCR content loader module makes it possible to import arbitrary files in the content repository, including local files, causing potential information leaks. Users should upgrade to version 2.1.6 of the JCR ContentLoader","cvss_v4":null,"cvss_v3":{"version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":7.5},"cwes":["CWE-200"],"references":["https://issues.apache.org/jira/browse/SLING-2512","https://lists.apache.org/thread.html/50994d80dd5cf93f1365dacfcaecf5c12f1efe522c4ff6040b3c521a%40%3Cdev.sling.apache.org%3E","https://issues.apache.org/jira/browse/SLING-2512","https://lists.apache.org/thread.html/50994d80dd5cf93f1365dacfcaecf5c12f1efe522c4ff6040b3c521a%40%3Cdev.sling.apache.org%3E"],"products":["apache:sling_jcr_contentloader"],"source":"nvd","synced_at":"2026-10-19T20:47:56.471723566+00:00"},"epss":{"cve":"CVE-2012-3353","score":0.03143,"percentile":0.87921,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-wjp3-4xcq-598p","url":"https://osv.dev/vulnerability/GHSA-wjp3-4xcq-598p","summary":"Apache Sling JCR ContentLoader XmlReader Arbitrary File Load","modified":"2024-02-16T08:21:55.179411Z","packages":[{"ecosystem":"Maven","name":"org.apache.sling:org.apache.sling.jcr.contentloader","purl":"pkg:maven/org.apache.sling/org.apache.sling.jcr.contentloader","ranges":["<2.1.6"],"fixed":["2.1.6"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}