What’s Vulnerable › Vulnerabilities

CVE-2022-32549: log injection in Sling logging

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-06-22 · updated 2026-06-17
• Weakness: CWE-117

Description

Apache Sling Commons Log <= 5.4.0 and Apache Sling API <= 2.25.0 are vulnerable to log injection. The ability to forge logs may allow an attacker to cover tracks by injecting fake logs and potentially corrupt log files.

Affected products

• Apache Sling Api: through 2.25.0
• Apache Sling Commons Log: through 5.4.0

References

• https://lists.apache.org/thread/7z6h3806mwcov5kx6l96pq839sn0po1v
• https://lists.apache.org/thread/7z6h3806mwcov5kx6l96pq839sn0po1v

Get alerted when CVE-2022-32549 or the next vulnerability affects your stack