GitHub Advisoryadvisory · Maven

GHSA-4c37-7m5h-c8m9 Apache Felix Webconsole: XSS in services console

MEDIUM Published 2025-02-10 Modified 2025-02-10 Official page ↗
Aliases
CVE-2025-25247
Ecosystem
Maven
Packages
org.apache.felix:org.apache.felix.webconsole
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2025-02-10

Affected packages

• Maven org.apache.felix:org.apache.felix.webconsole: >= 4.0.0, < 4.9.10 → fixed in 4.9.10 • Maven org.apache.felix:org.apache.felix.webconsole: >= 5.0.0, < 5.0.10 → fixed in 5.0.10

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Felix Webconsole. This issue affects Apache Felix Webconsole 4.x up to 4.9.8 and 5.x up to 5.0.8. Users are recommended to upgrade to version 4.9.10 or 5.0.10 or higher, which fixes the issue.

Related

Alias · CVE (1)

  • CVE-2025-25247 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Felix Webconsole. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References