CVE-2025-25247CWE-79

Apache Felix Webconsole: XSS in services console

Medium · published February 10, 2025

CVSS v3.1
6.1
EPSS
1%
Percentile
52.4
In the wild
Unconfirmed
What it is

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Felix Webconsole.

This issue affects Apache Felix Webconsole 4.x up to 4.9.8 and 5.x up to 5.0.8.

Users are recommended to upgrade to version 4.9.10 or 5.0.10 or higher, which fixes the issue.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00694 · 52.4th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-02-10T11:16Z
EPSS history
Timeline
  • 10 FEB 11:16Z
    Apache Felix Webconsole: XSS in services console
    cvelistv5