The vulnerability lies in the ContentDispositionFilter of the Apache Sling Security Bundle, which only mediates a single address or API shape of a resource. This limitation allows requests targeting alternate paths to bypass the filter, potentially exposing sensitive data or permitting unauthorized actions. The fault is classified as CWE-693, a faulty security mechanism that results in improper access control and could let a remote attacker access protected resources.

The issue affects Apache Sling Security Bundle from the Apache Software Foundation. All releases prior to version 1.3.12 are vulnerable. No further product variants were specified beyond the bundle itself.

The EPSS score is listed as less than 1 percent, indicating a very low probability of exploitation. The vulnerability is not currently listed in CISA’s KEV catalog. The CVSS score of 6.5 indicates a moderate severity, yet the very low EPSS score still suggests that active exploitation is unlikely. The attack would involve sending crafted HTTP requests to unmediated resource paths to exploit the missing filter coverage.