AEM: Security scanners report outdated bundled jQuery in /etc.clientlibs
Security scanners might report that Adobe Experience Manager serves an outdated jQuery version from /etc.clientlibs/... and might classify the finding as an unpatched vulnerability. This happens when the scanner identifies the bundled 1.12.4-aem version by version string alone. Adobe maintains 1.12.4-aem as a patched fork for backward compatibility. To address the finding, confirm whether the report is based only on version detection, review Adobe’s published guidance for the patched fork, avoid modifying Adobe-shipped client libraries directly, and use a project-owned client library if custom site code requires a newer jQuery version.
Description description
Environment
Adobe Experience Manager (AEM)
Issue
Security scanners may report that bundled JavaScript files served from paths such as /etc.clientlibs/clientlibs/granite/jquery.js use an outdated jQuery version. Security teams may interpret the version string alone as evidence of an unpatched vulnerability.
Example finding
The scanner may report a jQuery finding similar to the following:
jQuery - JavaScript - 1.12.4-aem
Cause
Some scanners identify bundled libraries by version string and do not verify whether the shipped code includes Adobe’s documented fixes. In AEM, 1.12.4-aem is an Adobe-maintained fork of jQuery that Adobe keeps for backward compatibility and updates with relevant security fixes.
Resolution resolution
Use the following guidance to assess the finding:
- Start by checking whether the finding is based only on version detection. If the scanner reports only the jQuery version string and does not include exploit evidence, treat the result as a version-based finding that still needs validation.
- Review Adobe’s published guidance for
1.12.4-aem. Adobe maintains1.12.4-aemas a patched jQuery fork for backward compatibility and documents fixes forCVE-2015-9251,CVE-2019-11358,CVE-2020-11022, andCVE-2020-11023. - Avoid modifying Adobe-shipped client libraries directly. Do not replace or edit Adobe-owned libraries as a product-level remediation step.
- If your implementation requires a newer jQuery version for custom frontend code, add and manage that version in a project client library under
/apps/<project>/clientlibs. Validate compatibility in lower environments before deployment. - Open a support case only when you can reproduce an issue against the current AEM build. Include the exact URL, affected file path, payload, and clear reproduction steps.