Read the docs
TI-2024-16547 Aliases CVE-2024-25090GHSA-g9rf-qc6j-h2f7

Improper input validation in Apache Roller

Priority LOW 26CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-79.

Summary

Insufficient input validation and sanitation in Profile name & screenname, Bookmark name & description and blogroll name features in all versions of Apache Roller on all platforms allows an authenticated user to perform an XSS attack. Mitigation: if you do not have Roller configured for untrusted users, then you need to do nothing because you trust your users to author raw HTML and other web content. If you are running with untrusted users then you should upgrade to Roller 6.1.3. This issue affects Apache Roller: from 5.0.0 before 6.1.3. Users are recommended to upgrade to version 6.1.3, which fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00752 55th percentileScored 2026-11-07
Fix Fixed Apache Roller (Apache Software Foundation): 6.1.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Roller5.0.0 to before 6.1.36.1.3Patch availableCNA
  • Apache Roller VendorApache Affected 5.0.0 to before 6.1.3 Fixed in 6.1.3 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:roller:*:*:*:*:*:*:*:*5.0.0 to before 6.1.3VulnerableApache
  • cpe:2.3:a:apache:roller:*:*:*:*:*:*:*:* Versions 5.0.0 to before 6.1.3 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache Roller (Apache Software Foundation) Fixed in 6.1.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-25090
  2. 2026-10-03 Alias added: GHSA-g9rf-qc6j-h2f7

References

Advisory 1

  • TI-2013-03684 Certain getText methods in the ActionSupport controller in Apache Roller before 5.0.2… CVSS 2.0MEDIUM 6.8
  • TI-2014-00028 The XML-RPC protocol support in Apache Roller before 5.0.3 allows attackers to conduct… CVSS 3.0CRITICAL 9.8
  • TI-2018-12297 Server-side request forgery in Apache Roller CVSS 3.0CRITICAL 9.8
  • TI-2021-12966 regex injection leading to DoS CVSS 3.1HIGH 7.5
  • TI-2015-00218 The weblog page template in Apache Roller 5.1 through 5.1.1 allows remote authenticated… CVSS 3.0HIGH 7.2
  • TI-2019-00207 Cross-site scripting in Apache Roller CVSS 3.1MEDIUM 6.1
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences