CVE-2023-37581

Medium

Description

Insufficient input validation and sanitation in Weblog Category name, Website About and File Upload features in all versions of Apache Roller on all platforms allows an authenticated user to perform an XSS attack. Mitigation: if you do not have Roller configured for untrusted users, then you need to do nothing because you trust your users to author raw HTML and other web content. If you are running with untrusted users then you should upgrade to Roller 6.1.2 and you should disable Roller's File Upload feature.

SeverityMedium

CVSS5.4

Exploit probability—

Product

Apache Roller

PublishedAug 6, 2023

First seenAug 6, 2023

Weakness typeCWE-79Cross-site scripting (XSS)

How to fix

Update

apache roller6.1.2 or later

Vendor advisories

lists.apache.org/thread/n9mjhhlm7z7b7to646tkvf3otkf21flp

Affected products

Product	Affected versions	Fixed in
apache roller	v < 6.1.2	6.1.2

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.