GitHub Advisoryadvisory · Maven

GHSA-2cv6-4f2r-jq2c Apache Felix HTTP Webconsole Plugin: XSS in HTTP Webconsole Plugin

MEDIUM Published 2025-03-12 Modified 2025-03-21 Official page ↗
Aliases
CVE-2025-27867
Ecosystem
Maven
Packages
org.apache.felix:org.apache.felix.http.webconsoleplugin
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-79
Reviewed
2025-03-12

Affected packages

• Maven org.apache.felix:org.apache.felix.http.webconsoleplugin: < 1.2.2 → fixed in 1.2.2

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Felix HTTP Webconsole Plugin. This issue affects Apache Felix HTTP Webconsole Plugin: from Version 1.X through 1.2.0. Users are recommended to upgrade to version 1.2.2, which fixes the issue.

Related

Alias · CVE (1)

  • CVE-2025-27867 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Felix HTTP Webconsole Plugin. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References