oss-security - FELIX-6753: CVE-2025-27867: Apache Felix HTTP Webconsole Plugin: XSS in HTTP Webconsole Plugin

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <1aec3651-68bc-c3bb-0990-d7a4213c9d89@apache.org>
Date: Wed, 12 Mar 2025 15:34:06 +0000
From: Carsten Ziegeler <cziegeler@...che.org>
To: oss-security@...ts.openwall.com
Subject: FELIX-6753: CVE-2025-27867: Apache Felix HTTP Webconsole Plugin:
 XSS in HTTP Webconsole Plugin 

Severity: moderate

Affected versions:

- Apache Felix HTTP Webconsole Plugin Version 1.x through 1.2.0

Description:

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Felix HTTP Webconsole Plugin.

This issue affects Apache Felix HTTP Webconsole Plugin: from Version 1.X through 1.2.0.

Users are recommended to upgrade to version 1.2.2, which fixes the issue.

Credit:

Viktor Mares (me@...tormares.com) (finder)

References:

https://felix.apache.org/
https://www.cve.org/CVERecord?id=CVE-2025-27867

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.