CVE-2025-25247

Published: Feb 10, 2025Modified: Jun 17, 2026

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Felix Webconsole. This issue affects Apache Felix Webconsole 4.x up to 4.9.8 and 5.x up to 5.0.8. Users are recommended to upgrade to version 4.9.10 or 5.0.10 or higher, which fixes the issue.

Affected (2)

Products: Apache: Felix Webconsole

1 product

Felix Webconsole

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Apache Felix Webconsole	From 4.0.0 to 4.9.10
Apache Felix Webconsole	From 5.0.0 to 5.0.10

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

https://lists.apache.org/thread/z47jbf0rbylzd0ktfzdw9c8b5fpyl24m

Source: security@apache.org

Issue TrackingMailing ListVendor Advisory

http://www.openwall.com/lists/oss-security/2025/02/10/1

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

Timeline

No history available yet.