AUGUST 4, 2026
Live Feed
Back to database
Case File

CVE-2013-2254

MEDIUM · CVSS 5 EPSS 4.09%

Source: NVD + CISA KEV + EPSS (historical backfill) · Published 2013-10-17 · Last synced 2026-08-04

CyberRota Analysis

AI analysis pending.

CVE
CVE-2013-2254
Severity
MEDIUM
CVSS
5
EPSS
4.09%
Apache Java

Original NVD Description

The deepGetOrCreateNode function in impl/operations/AbstractCreateOperation.java in org.apache.sling.servlets.post.bundle 2.2.0 and 2.3.0 in Apache Sling does not properly handle a NULL value that returned when the session does not have permissions to the root node, which allows remote attackers to cause a denial of service (infinite loop) via unspecified vectors.