CVE-2024-25090
Apache Roller: Insufficient input validation for some user profile and bookmark fields when Roller in untested-users mode
Insufficient input validation and sanitation in Profile name & screenname, Bookmark name & description and blogroll name features in all versions of Apache Roller on all platforms allows an authenticated user to perform an XSS attack. Mitigation: if you do not have Roller configured for untrusted users, then you need to do nothing because you trust your users to author raw HTML and other web content. If you are running with untrusted users then you should upgrade to Roller 6.1.3.
This issue affects Apache Roller: from 5.0.0 before 6.1.3.
Users are recommended to upgrade to version 6.1.3, which fixes the issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Insufficient input validation and sanitation in Profile name & screenname, Bookmark name & description and blogroll name features in all versions of Apache Roller on all platforms allows an authenticated user to perform an XSS attack. Mitigation: if you do not have Roller configured for untrusted users, then you need to do nothing because you trust your users to author raw HTML and other web content. If you are running with untrusted users then you should upgrade to Roller 6.1.3.
This issue affects Apache Roller: from 5.0.0 before 6.1.3.
Users are recommended to upgrade to version 6.1.3, which fixes the issue.
- Record
CVE-2024-25090- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-20, CWE-79
- Updated
- 2026-11-02
CVE List
Apache Roller: Insufficient input validation for some user profile and bookmark fields when Roller in untested-users mode
Insufficient input validation and sanitation in Profile name & screenname, Bookmark name & description and blogroll name features in all versions of Apache Roller on all platforms allows an authenticated user to perform an XSS attack. Mitigation: if you do not have Roller configured for untrusted users, then you need to do nothing because you trust your users to author raw HTML and other web content. If you are running with untrusted users then you should upgrade to Roller 6.1.3.
This issue affects Apache Roller: from 5.0.0 before 6.1.3.
Users are recommended to upgrade to version 6.1.3, which fixes the issue.
- Record
CVE-2024-25090- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-20, CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2024-22452
Insufficient input validation and sanitation in Profile name & screenname, Bookmark name & description and blogroll name features in all versions of Apache Roller on all platforms allows an authenticated user to perform an XSS attack. Mitigation: if you do not have Roller configured for untrusted users, then you need to do nothing because you trust your users to author raw HTML and other web content. If you are running with untrusted users then you should upgrade to Roller 6.1.3.
This issue affects Apache Roller: from 5.0.0 before 6.1.3.
Users are recommended to upgrade to version 6.1.3, which fixes the issue.
- Record
EUVD-2024-22452- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-g9rf-qc6j-h2f7
Insufficient input validation and sanitation in Profile name & screenname, Bookmark name &...
Insufficient input validation and sanitation in Profile name & screenname, Bookmark name & description and blogroll name features in all versions of Apache Roller on all platforms allows an authenticated user to perform an XSS attack. Mitigation: if you do not have Roller configured for untrusted users, then you need to do nothing because you trust your users to author raw HTML and other web content. If you are running with untrusted users then you should upgrade to Roller 6.1.3.
This issue affects Apache Roller: from 5.0.0 before 6.1.3.
Users are recommended to upgrade to version 6.1.3, which fixes the issue.
- Record
GHSA-g9rf-qc6j-h2f7- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
Apache Roller: Insufficient input validation for some user profile and bookmark fields when Roller in untested-users mode
Insufficient input validation and sanitation in Profile name & screenname, Bookmark name & description and blogroll name features in all versions of Apache Roller on all platforms allows an authenticated user to perform an XSS attack. Mitigation: if you do not have Roller configured for untrusted users, then you need to do nothing because you trust your users to author raw HTML and other web content. If you are running with untrusted users then you should upgrade to Roller 6.1.3.
This issue affects Apache Roller: from 5.0.0 before 6.1.3.
Users are recommended to upgrade to version 6.1.3, which fixes the issue.
- Record
CVE-2024-25090- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-20, CWE-79
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-25090 is a medium vulnerability (CVSS 5.4) in Apache Roller, published July 26, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.75%, the 55th percentile. No source names a fixed version.