CVE-2025-25247: Apache Felix Webconsole: XSS in services console
First published: Mon Feb 10 2025(Updated: )
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Felix Webconsole. This issue affects Apache Felix Webconsole 4.x up to 4.9.8 and 5.x up to 5.0.8. Users are recommended to upgrade to version 4.9.10 or 5.0.10 or higher, which fixes the issue.
Credit: security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| maven/org.apache.felix:org.apache.felix.webconsole | >=5.0.0<5.0.10 | 5.0.10 |
| maven/org.apache.felix:org.apache.felix.webconsole | >=4.0.0<4.9.10 | 4.9.10 |
| Apache Felix Web Console | <=4.9.8<=5.0.8 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://lists.apache.org/thread/z47jbf0rbylzd0ktfzdw9c8b5fpyl24m
- https://nvd.nist.gov/vuln/detail/CVE-2025-25247
- http://www.openwall.com/lists/oss-security/2025/02/10/1
- https://github.com/apache/felix-dev/commit/87513ea3533fdb79d9e2b251410bf2bfbd63941e
- https://github.com/advisories/GHSA-4c37-7m5h-c8m9 (Advisory)
Frequently Asked Questions
What is the severity of CVE-2025-25247?
CVE-2025-25247 is classified as a moderate severity vulnerability.
How do I fix CVE-2025-25247?
To fix CVE-2025-25247, upgrade Apache Felix Webconsole to version 4.9.10, 5.0.10, or higher.
Which versions of Apache Felix Webconsole are affected by CVE-2025-25247?
CVE-2025-25247 affects Apache Felix Webconsole versions 4.x up to 4.9.8 and 5.x up to 5.0.8.
What type of vulnerability is CVE-2025-25247?
CVE-2025-25247 is an improper neutralization of input during web page generation, commonly known as a Cross-site Scripting (XSS) vulnerability.
Is it safe to continue using Apache Felix Webconsole if affected by CVE-2025-25247?
It is not recommended to continue using affected versions of Apache Felix Webconsole due to the potential XSS risk posed by CVE-2025-25247.
- collector/oss-sec
- source/oss-sec
- alias/CVE-2025-25247
- agent/first-publish-date
- agent/title
- agent/weakness
- agent/description
- agent/type
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-4c37-7m5h-c8m9
- agent/software-canonical-lookup
- collector/nvd-cve
- source/NVD
- agent/severity
- agent/last-modified-date
- agent/author
- agent/references
- agent/softwarecombine
- agent/trending
- agent/event
- collector/nvd-api
- agent/source
- collector/mitre-cve
- source/MITRE
- collector/github-advisory
- agent/tags
- agent/epss
- collector/epss-latest
- source/FIRST
- agent/guess-ai
- agent/software-canonical-lookup-request
- package-manager/maven
- vendor/apache
- canonical/apache felix web console