{"cve":"CVE-2024-23673","nvd":{"published":"2024-02-06T10:15:08.833","modified":"2026-06-17T07:13:21.547","status":"Modified","description":"Malicious code execution via path traversal in Apache Software Foundation Apache Sling Servlets Resolver.This issue affects all version of Apache Sling Servlets Resolver before 2.11.0. However, whether a system is vulnerable to this attack depends on the exact configuration of the system.\nIf the system is vulnerable, a user with write access to the repository might be able to trick the Sling Servlet Resolver to load a previously uploaded script. \n\nUsers are recommended to upgrade to version 2.11.0, which fixes this issue. It is recommended to upgrade, regardless of whether your system configuration currently allows this attack or not.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.5},"cwes":["CWE-22"],"references":["http://www.openwall.com/lists/oss-security/2024/02/06/1","https://lists.apache.org/thread/5zzx8ztwc6tmbwlw80m2pbrp3913l2kl","http://www.openwall.com/lists/oss-security/2024/02/06/1","https://lists.apache.org/thread/5zzx8ztwc6tmbwlw80m2pbrp3913l2kl"],"products":["apache:sling_servlets_resolver"],"source":"nvd","synced_at":"2026-10-19T21:44:57.175229480+00:00"},"epss":{"cve":"CVE-2024-23673","score":0.01321,"percentile":0.7088,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-h2rq-qhr7-53gm","url":"https://osv.dev/vulnerability/GHSA-h2rq-qhr7-53gm","summary":"Apache Sling Servlets Resolver executes malicious code via path traversal","modified":"2025-02-13T19:37:05.581192Z","packages":[{"ecosystem":"Maven","name":"org.apache.sling:org.apache.sling.servlets.resolver","purl":"pkg:maven/org.apache.sling/org.apache.sling.servlets.resolver","ranges":["<2.11.0"],"fixed":["2.11.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}