PT-2025-31494 · Unknown+1 · Apache Jspwiki+1

Both Xbow · Published 2025-07-31 · Updated 2025-08-04 · CVE-2025-24854

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Apache JSPWiki versions prior to 2.12.3

Description A carefully crafted request using the Image plugin could trigger a cross-site scripting (XSS) issue on Apache JSPWiki. This could allow an attacker to execute JavaScript in the victim's browser and potentially obtain sensitive information.

Recommendations Upgrade to version 2.12.3 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-24854

GHSA-72WW-4RCW-MC62

Affected Products

Apache Jspwiki

Image Plugin

References · 10

• https://osv.dev/vulnerability/CVE-2025-24854 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-72ww-4rcw-mc62 · Vendor Advisory
• https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2025-24854 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-24854 · Security Note
• https://github.com/apache/jspwiki · Note
• https://t.me/cveNotify/130364 · Telegram Post
• http://openwall.com/lists/oss-security/2025/07/30/3 · Note
• https://t.me/cveNotify/130745 · Telegram Post
• https://t.me/CVEtracker/28841 · Telegram Post
• https://twitter.com/CVEnew/status/1950842236557578604 · Twitter Post