Thanks @gkalyan  for the help! Updates on the fix:1. This is not cache poisoning.2. The error was happening when the site was being called with a manipulated header as "Handle: somestring"3. While "Handle" is not a standard header and a custom one, we verified that default output instead of a 403 is...

how can we do this?our configs:/conf.d/available_vhosts/aem-site_publish.vhost <IfModule mod_headers.c> Header set X-XSS-Protection "1; mode=block" Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" # Header always add X-Vhost "publish" Header merge X...

We have Server version: Apache/2.4.62 installed, this says was fixed in 2.4.55

thanks @gkal , will try this.

We have observed this vulnerability on our website built on AEM 6.5, Apache 2.4, cache enabled. Cache poison via malicious request headerServer/Application Misconfiguration Cache poisoningA cache poisoning vulnerability has been identified: issue at domain.comThe request header Handlechanges the res...