AI analysis
Apache Sling XSS before 2.4.12 contains a cross-site scripting flaw (CWE-79) caused by improper neutralization of input during web page generation, reported as improper escaping in the XSS Webconsole plugin. An attacker crafts a request whose payload is reflected unescaped into the plugin's generated web console page, and the malicious script executes when a victim is tricked into viewing that page (user interaction required, no privileges needed). Successful exploitation lets the attacker run script in the victim's browser in the context of the Sling console, yielding limited confidentiality and integrity impact such as session or token theft and actions performed as the victim, with no availability impact. Any deployment using Apache Sling XSS versions before 2.4.12 is affected; users are advised to upgrade to 2.4.12. There is no known public proof of concept, the issue is not in CISA's KEV catalog, and no exploitation has been observed.
What to do: Upgrade the Apache Sling XSS bundle to version 2.4.12 or later on all Sling-based deployments (including AEM-based systems that ship the Sling XSS bundle). As defense in depth, restrict the OSGi Web Console to localhost or trusted internal networks and require authentication, and audit logs for suspicious crafted URLs hitting webconsole endpoints. Verify the fix by confirming the installed org.apache.sling.xss bundle version is 2.4.12+.
Affected
| Apache Software Foundation Apache Sling XSS | before 2.4.12 (fixed in 2.4.12) |
Estimated exposure
nichelikely under 10,000 internet-exposed Sling-based servers, with the Web Console typically internal — Apache Sling is an enterprise Java web framework (notably underlying Adobe Experience Manager) deployed on enterprise infrastructure rather than at mass scale, and the affected Webconsole plugin is usually bound to admin/internal…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue.