VULNERABILITY INTELLIGENCE

CVE-2025-25247

CVSS score6.1 MEDIUM

EPSS probability0.69%

CISA KEVNot currently listed

Published2025-02-10

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Felix Webconsole. This issue affects Apache Felix Webconsole 4.x up to 4.9.8 and 5.x up to 5.0.8. Users are recommended to upgrade to version 4.9.10 or 5.0.10 or higher, which fixes the issue.

Weakness classification

security@apache.org: CWE-79

Primary references

security@apache.org — Issue Tracking, Mailing List, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Third Party Advisory