PT-2023-26420 · Apache · Apache Felix Healthcheck Webconsole Plugin

Published 2023-07-25 · Updated 2023-12-13 · CVE-2023-38435

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache Felix Healthcheck Webconsole Plugin versions 2.0.2 and prior

Description An improper neutralization of input during web page generation, also known as Cross-site Scripting, may allow an attacker to perform a reflected cross-site scripting (XSS) attack. This issue is related to the Apache Felix Healthcheck Webconsole Plugin.

Recommendations Upgrade to Apache Felix Healthcheck Webconsole Plugin 2.1.0 or higher.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-38435

GHSA-4PVW-G9FX-594R

Affected Products

Apache Felix Healthcheck Webconsole Plugin

References · 10

• https://lists.apache.org/thread/r3blhp3onr4rdbkgdyglqnccg0v79pfv · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4pvw-g9fx-594r · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-38435 · Security Note
• https://osv.dev/vulnerability/CVE-2023-38435 · Vendor Advisory
• https://github.com/apache/felix-dev · Note
• https://github.com/apache/felix-dev/commit/c4e67520e0a4499389342491869919a6c42ed62c · Note
• http://openwall.com/lists/oss-security/2023/07/25/10 · Note
• http://seclists.org/fulldisclosure/2023/Jul/43 · Note
• https://t.me/cibsecurity/67253 · Telegram Post
• https://t.me/cvenotify/61890 · Telegram Post