You are viewing a plain text version of this content. The canonical link for it is here.

Posted to users@felix.apache.org by Carsten Ziegeler <cz...@apache.org> on 2025/03/12 15:34:06 UTC

FELIX-6753: CVE-2025-27867: Apache Felix HTTP Webconsole Plugin: XSS in HTTP Webconsole Plugin

Severity: moderate

Affected versions:

- Apache Felix HTTP Webconsole Plugin Version 1.x through 1.2.0

Description:

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Felix HTTP Webconsole Plugin.

This issue affects Apache Felix HTTP Webconsole Plugin: from Version 1.X through 1.2.0.

Users are recommended to upgrade to version 1.2.2, which fixes the issue.

Credit:

Viktor Mares (me@viktormares.com) (finder)

References:

https://felix.apache.org/
https://www.cve.org/CVERecord?id=CVE-2025-27867


---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@felix.apache.org
For additional commands, e-mail: users-help@felix.apache.org