PT-2025-11107 · Apache · Apache Felix Http Webconsole Plugin

Viktor Mares · Publicado 2025-03-12 · Atualizado 2025-07-16 · CVE-2025-27867

Positive Technologies (AI Summary)

CVSS v3.1

5.6

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions: Apache Felix HTTP Webconsole Plugin versions 1.X through 1.2.0

Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. Users are advised to upgrade to a newer version to fix the issue.

Recommendations: For Apache Felix HTTP Webconsole Plugin versions 1.X through 1.2.0, upgrade to version 1.2.2 to resolve the issue.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2025-06482

CVE-2025-27867

GHSA-2CV6-4F2R-JQ2C

Produtos afetados

Apache Felix Http Webconsole Plugin

Referências · 15

• https://github.com/apache/felix-dev · Nota
• https://twitter.com/oss_security/status/1900026367397265749 · Publicação no Twitter
• https://bdu.fstec.ru/vul/2025-06482 · Nota de Segurança
• https://twitter.com/CVEnew/status/1899894901774704983 · Publicação no Twitter
• https://vuldb.com/ru/?id.299586 · Nota
• https://lists.apache.org/thread/y83f2rvm8bccr5ctgv7mzxd69p6f77dp · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2025/03/12/3 · Nota
• https://t.me/cvetracker/19006 · Publicação no Telegram
• https://t.me/cvenotify/129169 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2025-27867 · Aviso do Fabricante
• https://openwall.com/lists/oss-security/2025/03/12/3 · Nota
• https://t.me/cvenotify/129214 · Publicação no Telegram
• https://t.me/cvedetector/20150 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-2cv6-4f2r-jq2c · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-27867 · Nota de Segurança