PT-2025-11107 · Apache · Apache Felix Http Webconsole Plugin

Viktor Mares · Published 2025-03-12 · Updated 2025-07-16 · CVE-2025-27867

Positive Technologies (AI Summary)

CVSS v3.1

5.6

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions: Apache Felix HTTP Webconsole Plugin versions 1.X through 1.2.0

Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. Users are advised to upgrade to a newer version to fix the issue.

Recommendations: For Apache Felix HTTP Webconsole Plugin versions 1.X through 1.2.0, upgrade to version 1.2.2 to resolve the issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2025-06482

CVE-2025-27867

GHSA-2CV6-4F2R-JQ2C

Affected Products

Apache Felix Http Webconsole Plugin

References · 15

• https://bdu.fstec.ru/vul/2025-06482 · Security Note
• https://lists.apache.org/thread/y83f2rvm8bccr5ctgv7mzxd69p6f77dp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-27867 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2cv6-4f2r-jq2c · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-27867 · Security Note
• https://github.com/apache/felix-dev · Note
• https://twitter.com/oss_security/status/1900026367397265749 · Twitter Post
• https://twitter.com/CVEnew/status/1899894901774704983 · Twitter Post
• https://vuldb.com/ru/?id.299586 · Note
• http://openwall.com/lists/oss-security/2025/03/12/3 · Note
• https://t.me/cvetracker/19006 · Telegram Post
• https://t.me/cvenotify/129169 · Telegram Post
• https://openwall.com/lists/oss-security/2025/03/12/3 · Note
• https://t.me/cvenotify/129214 · Telegram Post
• https://t.me/cvedetector/20150 · Telegram Post