Apache Sling Commons JSON Library 2.0.20 vulnerability (CVE-2022-47937) from aem-mock.core/5.2.2 and cq-wcm-foundation/5.6.4

Please direct these types of questions to Adobe support.

* First, this is the way you get an official Adobe response. In this forum no one can speak for Adobe, but it's just individual responses.

* Secondly, any kind of security related discussions should be dealt with directly with Adobe support, as there you can expect responses according to the SLA, while here in the forums it is best effort. Also please provide accurate version information (for example which AEM version and which servicepack you have deployed).

To add some context to your question:

* the aem-mock library  is not maintained by Adobe, but by the wcm.io project. Please direct this question to them.

* You cannot rely on the pom information only; as AEM uses OSGI under the hoods, listed bundle versions normally list just the minimal package version and more often newer versions are installed and used. So while the bundle can still reference an older vulnerable version (and would work with it), AEM ships with a new version which does not have that vulnerability anymore. For that reason the results of those simple scans are often misleading. You always need to doublecheck what is actually deployed within your AEM instance.