CVE-2024-25090mediumCWE-20CWE-79

CVE-2024-25090: medium-severity vulnerability in Apache Roller

Apache Roller: Insufficient input validation for some user profile and bookmark fields when Roller in untested-users mode

Published · Updated

Follow this CVE+ Monitor Apache Roller

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.4epss 0.8%
Insufficient input validation and sanitation in Profile name & screenname, Bookmark name & description and blogroll name features in all versions of Apache Roller on all platforms allows an authenticated user to perform an XSS attack. Mitigation: if you do not have Roller configured for untrusted users, then you need to do nothing because you trust your users to author raw HTML and other web content. If you are running with untrusted users then you should upgrade to Roller 6.1.3. This issue affects Apache Roller: from 5.0.0 before 6.1.3. Users are recommended to upgrade to version 6.1.3, which fixes the issue.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected products
Apache Software Foundation · Apache Roller
Related CVEs — Apache Roller

In the same product, most dangerous first.

CVE-2018-17198—CVE-2018-17198EPSS 4.1%CVE-2021-33580—regex injection leading to DoSEPSS 3.3%CVE-2023-37581—Apache Roller: Roller's weblog category, weblog settings and file-upload features did not properly sanitize input could be exploited to perform Reflected Cross Site Scripting (XSS) even on a Roller site configured for untrusted users.EPSS 1.2%CVE-2025-24859LOWApache Roller: Insufficient Session Expiration on Password ChangeEPSS 1.2%CVE-2026-82384CRITICALApache Roller: Unauthenticated deserialization in the XML-RPC endpointEPSS 1.0%CVE-2026-82383HIGHApache Roller: Anonymous setup action allows frontpage configuration tamperingEPSS 0.5%