Cross-Site Scripting Vulnerability in Apache Felix HTTP Webconsole Plugin
CVE-2025-27867

Currently unrated

Key Information:

Vendor: Apache
Status: Apache Felix Http Webconsole Plugin
Vendor: CVE Published:; 12 March 2025

Summary

The Apache Felix HTTP Webconsole Plugin is impacted by a Cross-site Scripting (XSS) vulnerability that arises from improper neutralization of input during web page generation. This flaw affects versions 1.X through 1.2.0 of the plugin. Users are strongly encouraged to upgrade to version 1.2.2, which addresses this issue and enhances the security of the web console.

Affected Version(s)

Apache Felix HTTP Webconsole Plugin 1.x <= 1.2.0

References

https://lists.apache.org/thread/y83f2rvm8bccr5ctgv7mzxd69...

vendor-advisory

Timeline

Vulnerability published
Mar 12, 2025
Vulnerability Reserved
Mar 9, 2025

Credit

Viktor Mares ([email protected])