Cross-Site Scripting Vulnerability in Apache Felix HTTP Webconsole Plugin
CVE-2025-27867

5.6MEDIUM

Key Information:

Vendor

Apache
Status
Apache Felix Http Webconsole Plugin
Vendor
CVE Published:
12 March 2025

What is CVE-2025-27867?

The Apache Felix HTTP Webconsole Plugin is impacted by a Cross-site Scripting (XSS) vulnerability that arises from improper neutralization of input during web page generation. This flaw affects versions 1.X through 1.2.0 of the plugin. Users are strongly encouraged to upgrade to version 1.2.2, which addresses this issue and enhances the security of the web console.

Affected Version(s)

Apache Felix HTTP Webconsole Plugin 1.x <= 1.2.0

References

https://lists.apache.org/thread/y83f2rvm8bccr5ctgv7mzxd69...
vendor-advisory

CVSS V3.1

Score:
5.6
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Viktor Mares ([email protected])
JSON
.