TI-2023-19179 Aliases CVE-2023-37581 GHSA-mccf-357g-w594

Cross-site scripting in Apache Roller

LOW 27CWE-79Published 2023-08-06 · Updated 2024-10-01

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

Insufficient input validation and sanitation in Weblog Category name, Website About and File Upload features in all versions of Apache Roller on all platforms allows an authenticated user to perform an XSS attack. Mitigation: if you do not have Roller configured for untrusted users, then you need to do nothing because you trust your users to author raw HTML and other web content. If you are running with untrusted users then you should upgrade to Roller 6.1.2 and you should disable Roller's File Upload feature.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.01172 67th percentileScored 2026-11-07

Fix Fixed Apache Roller (Apache Software Foundation): 6.1.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Apache	Apache Roller	before 6.1.2	6.1.2	Patch available	CNA

Apache Roller VendorApache Affected before 6.1.2 Fixed in 6.1.2 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:apache:roller::::::::	before 6.1.2	Vulnerable	Apache

cpe:2.3:a:apache:roller:*:*:*:*:*:*:*:* Versions before 6.1.2 Vulnerable ·Apache

Remediation

Fix · CNA Apache Roller (Apache Software Foundation) Fixed in 6.1.2

Timeline

2026-10-02 Threatist record created from CVE-2023-37581
2026-10-03 Alias added: GHSA-mccf-357g-w594

References

Advisory 1

https://lists.apache.org/thread/n9mjhhlm7z7b7to646tkvf3otkf21flp

Other 1

https://www.openwall.com/lists/oss-security/2023/08/16/1

TI-2013-03684 Certain getText methods in the ActionSupport controller in Apache Roller before 5.0.2… CVSS 2.0MEDIUM 6.8
TI-2014-00028 The XML-RPC protocol support in Apache Roller before 5.0.3 allows attackers to conduct… CVSS 3.0CRITICAL 9.8
TI-2018-12297 Server-side request forgery in Apache Roller CVSS 3.0CRITICAL 9.8
TI-2021-12966 regex injection leading to DoS CVSS 3.1HIGH 7.5
TI-2015-00218 The weblog page template in Apache Roller 5.1 through 5.1.1 allows remote authenticated… CVSS 3.0HIGH 7.2
TI-2019-00207 Cross-site scripting in Apache Roller CVSS 3.1MEDIUM 6.1

See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences