CVE-2025-24853
Apache JSPWiki: Cross-Site Scripting (XSS) in JSPWiki Header Link processing
A carefully crafted request when creating a header link using the wiki markup syntax, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.
Further research by the JSPWiki team showed that the markdown parser allowed this kind of attack too.
Apache JSPWiki users should upgrade to 2.12.3 or later.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Apache JSPWiki: Cross-Site Scripting (XSS) in JSPWiki Header Link processing
A carefully crafted request when creating a header link using the wiki markup syntax, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.
Further research by the JSPWiki team showed that the markdown parser allowed this kind of attack too.
Apache JSPWiki users should upgrade to 2.12.3 or later.
- Record
CVE-2025-24853- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2025-23255
A carefully crafted request when creating a header link using the wiki markup syntax, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.
Further research by the JSPWiki team showed that the markdown parser allowed this kind of attack too.
Apache JSPWiki users should upgrade to 2.12.3 or later.
- Record
EUVD-2025-23255- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-rrff-chj9-w4c7
Apache JSPWiki Cross-Site Scripting (XSS) Vulnerability via Header Link Rendering
A carefully crafted request when creating a header link using the wiki markup syntax, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.
Further research by the JSPWiki team showed that the markdown parser allowed this kind of attack too.
Apache JSPWiki users should upgrade to 2.12.3 or later.
- Record
GHSA-rrff-chj9-w4c7- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
A carefully crafted request when creating a header link using the wiki markup syntax, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.
Further research by the JSPWiki team showed that the markdown parser allowed this kind of attack too.
Apache JSPWiki users should upgrade to 2.12.3 or later.
- Record
CVE-2025-24853- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Apache JSPWiki: Cross-Site Scripting (XSS) in JSPWiki Header Link processing
A carefully crafted request when creating a header link using the wiki markup syntax, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.
Further research by the JSPWiki team showed that the markdown parser allowed this kind of attack too.
Apache JSPWiki users should upgrade to 2.12.3 or later.
- Record
CVE-2025-24853- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-rrff-chj9-w4c7
Apache JSPWiki Cross-Site Scripting (XSS) Vulnerability via Header Link Rendering
A carefully crafted request when creating a header link using the wiki markup syntax, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.
Further research by the JSPWiki team showed that the markdown parser allowed this kind of attack too.
Apache JSPWiki users should upgrade to 2.12.3 or later.
- Record
GHSA-rrff-chj9-w4c7- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.jspwiki:jspwiki-mainMaven |
before 2.12.3 | 2.12.3 |
org.apache.jspwiki:jspwiki-markdownMaven |
before 2.12.3 | 2.12.3 |
org.apache.jspwiki:jspwiki-mainMaven |
before 2.12.3, plus listed versions 2.11.02.11.0.M12.11.0.M22.11.0.M32.11.0.M4 Show 10 moreShow less2.11.0.M52.11.0.M62.11.0.M72.11.0.M82.11.12.11.22.11.32.12.02.12.12.12.2 |
2.12.3 |
org.apache.jspwiki:jspwiki-markdownMaven |
before 2.12.3, plus listed versions 2.10.32.10.42.10.52.11.02.11.0.M1 Show 13 moreShow less2.11.0.M22.11.0.M32.11.0.M42.11.0.M52.11.0.M62.11.0.M72.11.0.M82.11.12.11.22.11.32.12.02.12.12.12.2 |
2.12.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-24853 is a high vulnerability (CVSS 7.5) in Apache Jspwiki, published July 31, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.60%, the 48th percentile. Fixed in org.apache.jspwiki:jspwiki-main 2.12.3.
References
jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2025-24853
openwall.com/lists/oss-security/2025/07/30/2
nvd.nist.gov/vuln/detail/CVE-2025-24853
github.com/apache/jspwiki/pull/376