title: log injection in Sling logging
description: Apache Sling Commons Log <= 5.4.0 and Apache Sling API <= 2.25.0 are vulnerable to log injection. The ability to forge logs may allow an attacker to cover tracks by injecting fake logs and potentially corrupt log files.
problem types: CWE-117: Improper Output Neutralization for Logs
affected:
{
product: Apache Sling
vendor: Apache Software Foundation
versions:
lessThanOrEqual: 2.25.0, status: affected, version: Apache Sling API, versionType: custom
lessThanOrEqual: 5.4.0, status: affected, version: Apache Sling Commons Log, versionType: custom
}
metrics:
other: [
content: {'other': 'important'}
type: unknown
]