WebDAV should be disabled on the publish environment.

See the CRX documentation for further details.

By configuring the Dispatcher you should restrict access so that only the following are available to external visitors:

The following should be entered in the configuration file dispatcher.any:

# only handle the requests in the following acl. default is 'none'
# the glob pattern is matched against the first request line
/filter
  {
  /0001
    {
    /glob "*"
    /type "deny"
    }
  /0002
    {
    /glob "* /content[./]"
    /type "allow"
    }
  /0003
    {
    /glob "* /etc[./]"
    /type "allow"
}

Note

This configuration includes the following restrictions: Restricts access to the Servlet Engine Administration /admin Restricts access to the Sling Console /system Restricts access to CRX /crx Restricts access to the following application specific folders: /apps – Application data /libs – CQ5 Library /var – var folder /etc – Miscellaneous folder /home – User’s home folder Restricts access to /tmp Denies POST requests in case forms are not used.

Cross-site scripting (XSS) allows attackers to inject code into web pages viewed by other users. This security vulnerability can be exploited by malicious web users to bypass access controls.

	Warning
	CQ5 example code is not protected against such attacks.