VulnerabilityAnalyzed

CVE-2025-25247

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Felix Webconsole.

MEDIUM 6.1EPSS 0.69%

Does this matter?

Lower severity and a low EPSS score (0.69%). Track it; it rarely justifies an emergency change on its own.

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Felix Webconsole. This issue affects Apache Felix Webconsole 4.x up to 4.9.8 and 5.x up to 5.0.8. Users are recommended to upgrade to version 4.9.10 or 5.0.10 or higher, which fixes the issue.

CVSS 3.1: 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS: 0.69% probability · 51th percentile
CISA KEV: Not listed
Weakness: CWE-79
Affected: apache/felix webconsole
Source: security@apache.org

References

https://lists.apache.org/thread/z47jbf0rbylzd0ktfzdw9c8b5fpyl24mIssue Tracking, Mailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2025/02/10/1Mailing List, Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.