Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.2 through 6.1.6 allows a weblog administrator to store script that runs in the browsers of the weblog's members when they open their main menu. The HTML-stripping routine kept a tag that was not closed, and the main menu printed the weblog description without escaping. Users are recommended to upgrade to Apache Roller 6.1.7 or later.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Roller | 6.1.2 – ≤ 6.1.6 | — |