Moderate severityNVD Advisory· Published Oct 17, 2013· Updated Jun 16, 2026
CVE-2013-2254
CVE-2013-2254
Description
The deepGetOrCreateNode function in impl/operations/AbstractCreateOperation.java in org.apache.sling.servlets.post.bundle 2.2.0 and 2.3.0 in Apache Sling does not properly handle a NULL value that returned when the session does not have permissions to the root node, which allows remote attackers to cause a denial of service (infinite loop) via unspecified vectors.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.apache.sling:org.apache.sling.apiMaven | < 2.4.0 | 2.4.0 |
Affected products
3cpe:2.3:a:apache:org.apache.sling.servlets.post:2.2.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:apache:org.apache.sling.servlets.post:2.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:apache:org.apache.sling.servlets.post:2.3.0:*:*:*:*:*:*:*
Patches
Vulnerability mechanics
References
7- issues.apache.org/jira/browse/SLING-2913nvdExploitPatchWEB
- mail-archives.apache.org/mod_mbox/sling-dev/201310.mbox/%3CCAKkCf4pue6PnESsP1KTdEDJm1gpkANFaK%2BvUd9mzEVT7tXL%2B3A%40mail.gmail.com%3EnvdVendor AdvisoryWEB
- secunia.com/advisories/55157nvdVendor Advisory
- github.com/advisories/GHSA-cxwh-vmhg-39r2ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2013-2254ghsaADVISORY
- exchange.xforce.ibmcloud.com/vulnerabilities/87765nvdWEB
- www.securityfocus.com/bid/62903nvd
News mentions
0No linked articles in our index yet.