Skip to content
OpenAdvisories
Medium · 5.6 CVE-2025-27867 EUVD-2025-7206GHSA-2cv6-4f2r-jq2c

Apache Felix HTTP Webconsole Plugin: XSS in HTTP Webconsole Plugin

Published Mar 12, 2025 · Updated Mar 21, 2025 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Felix HTTP Webconsole Plugin Package: org.apache.felix:org.apache.felix.http.webconsoleplugin Ecosystem: Maven

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Felix HTTP Webconsole Plugin.

This issue affects Apache Felix HTTP Webconsole Plugin: from Version 1.X through 1.2.0.

Users are recommended to upgrade to version 1.2.2, which fixes the issue.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache Felix HTTP Webconsole Plugin 1.x – ≤ 1.2.0 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.apache.felix:org.apache.felix.http.webconsoleplugin < 1.2.2 1.2.2 GHSA-2cv6-4f2r-jq2c

References