Medium severity5.3NVD Advisory· Published Jun 22, 2022· Updated Jun 17, 2026

CVE-2022-32549

Description

Apache Sling Commons Log <= 5.4.0 and Apache Sling API <= 2.25.0 are vulnerable to log injection. The ability to forge logs may allow an attacker to cover tracks by injecting fake logs and potentially corrupt log files.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
org.apache.sling:org.apache.sling.commons.logMaven	<= 5.4.0	—
org.apache.sling:org.apache.sling.apiMaven	<= 2.25.0	—

Affected products

Apache/Sling2 versions
cpe:2.3:a:apache:sling_api:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:apache:sling_api:*:*:*:*:*:*:*:*range: <=2.25.0
- (no CPE)range: Apache Sling API
Apache/Sling Commons Log
cpe:2.3:a:apache:sling_commons_log:*:*:*:*:*:*:*:*
Range: <=5.4.0
ghsa-coords2 versions
pkg:maven/org.apache.sling/org.apache.sling.api pkg:maven/org.apache.sling/org.apache.sling.commons.log
<= 2.25.0+ 1 more
- (no CPE)range: <= 2.25.0
- (no CPE)range: <= 5.4.0

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-qmx3-m648-hr74ghsaADVISORY
lists.apache.org/thread/7z6h3806mwcov5kx6l96pq839sn0po1vnvdMailing ListVendor AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2022-32549ghsaADVISORY

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.002
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000