AI analysis
The ContentDispositionFilter in the Apache Sling Security Bundle only mediates one address/API shape for accessing a repository resource, so the same content can be fetched through alternative URL or servlet forms that the filter never inspects. This is a protection-mechanism failure: content that should have been forced into an 'attachment' download (for example user-stored HTML or SVG that could be rendered inline) can instead be served inline in the site's origin. An unauthenticated remote attacker who can get such content into the repository could then trick a victim's browser into executing it in-context, yielding content-type confusion / stored cross-site scripting with low confidentiality and low integrity impact (CVSS 3.1: 6.5). All deployments running the Sling Security Bundle before 1.3.12 are affected — note that Sling is also the underlying web framework inside Adobe Experience Manager (AEM), so enterprise AEM stacks may embed an affected bundle version. No public proof of concept is known, the flaw is not in CISA's KEV catalog, and there are no reports of exploitation in the wild.
What to do: Upgrade the Apache Sling Security Bundle to 1.3.12 or later (for AEM-based stacks, apply the vendor bundle update or service pack that ships the fixed version rather than hot-swapping it yourself). Until patched, restrict who can upload or author content in the repository, sanitize or quarantine stored HTML/SVG, and verify that Content-Disposition: attachment headers are actually applied on every URL shape used to reach stored resources. Review access logs for unusual selector, extension, or alternate-API request patterns hitting repository paths as an indicator of probing.
Affected
| Apache Software Foundation Apache Sling Security Bundle (ContentDispositionFilter) | before 1.3.12 (fixed in 1.3.12) |
Estimated exposure
moderate≈ low thousands of internet-exposed Sling/AEM endpoints, plus an unknown number of internal enterprise deployments — Apache Sling is rarely deployed standalone and is most commonly embedded in Adobe AEM; internet-wide scans for Sling/AEM endpoint fingerprints historically show only a few thousand exposed systems, with most AEM installs sitting behind…
Description
A vulnerability in Apache Sling Security Bundle: ContentDispositionFilter mediates only one address/API shape of a resource This issue affects Apache Sling Security Bundle: before 1.3.12. Users are recommended to upgrade to version 1.3.12, which fixes the issue.