PT-2024-5531 · Apache · Apache Roller

Jacob Hazak · Published 2024-07-26 · Updated 2024-08-16 · CVE-2024-25090

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache Roller versions 5.0.0 through 6.1.2

Description The issue is caused by insufficient input validation and sanitation in features such as Profile name & screenname, Bookmark name & description, and blogroll name. This allows an authenticated user to perform a cross-site scripting (XSS) attack. The vulnerability can be exploited by a remote attacker to conduct an XSS attack.

Recommendations For Apache Roller versions 5.0.0 through 6.1.2, upgrade to version 6.1.3 to fix the issue. If you do not have Roller configured for untrusted users, no action is required as you trust your users to author raw HTML and other web content. However, if you are running with untrusted users, upgrading to version 6.1.3 is necessary.

Fix

XSS

RCE

Weakness Enumeration

CWE-79

CWE-20

Related Identifiers

BDU:2024-06197

CVE-2024-25090

Affected Products

Apache Roller

References · 9

• https://lists.apache.org/thread/lb50jqyxwf8jrfpydl6dc5zpqtpgrrwd · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-25090 · Security Note
• https://osv.dev/vulnerability/CVE-2024-25090 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-06197 · Security Note
• https://t.me/cvenotify/87514 · Telegram Post
• https://t.me/cvenotify/90983 · Telegram Post
• https://t.me/cvedetector/1672 · Telegram Post
• http://openwall.com/lists/oss-security/2024/07/25/2 · Note
• https://vuldb.com/?id.272472 · Note