AI analysis
Apache Sling XSS, the Java library (org.apache.sling.xss) that Sling-based applications use to sanitize user-supplied HTML and rich text before rendering, fails to properly neutralize crafted input, allowing a cross-site scripting (XSS) protection bypass. An attacker submits specially structured markup that slips past the sanitizer; when a victim views a page containing that content, the attacker's script executes in the victim's browser session, enabling session/cookie theft, defacement, or in-session actions against Sling-based applications such as Adobe Experience Manager, which embeds this library. The flaw (CVSS 3.1: 6.1, medium) is network-reachable without privileges but requires user interaction and yields only limited confidentiality and integrity impact. All deployments using Apache Sling XSS before version 2.4.12 are affected, and the fix is an upgrade to 2.4.12. No public proof-of-concept is known, the issue is not in CISA's Known Exploited Vulnerabilities catalog, and there is no indication of in-the-wild exploitation.
What to do: Upgrade the org.apache.sling.xss bundle to 2.4.12 or later, or apply the Adobe service pack/security bulletin that ships the fixed bundle if you run AEM rather than managing Sling bundles directly. Until patched, restrict who can submit rich-text/HTML content, apply additional server-side encoding or an alternate sanitizer to user-generated markup, and audit stored content for scripts that may have bypassed the old sanitizer. Review application logs and CMS content for suspicious injected payloads and rotate credentials for any sessions that interacted with tainted pages.
Affected
| Apache Software Foundation Apache Sling XSS (org.apache.sling.xss) | before 2.4.12 |
Estimated exposure
moderate≈ several thousand internet-exposed AEM/Sling servers, with the library embedded in many more enterprise sites (estimate) — Apache Sling is the foundation of Adobe Experience Manager, and public internet scans (Shodan/Censys) typically show low-thousands of exposed AEM/Sling endpoints, while AEM powers a large population of enterprise and public-facing websites…
Description
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue.