CVE-2025-25247 Apache Felix Webconsole: XSS in services console

🗓️ 10 Feb 2025 11:16:59Reported by apacheType

XSS vulnerability in Apache Felix Webconsole affects versions up to 4.9.8 and 5.0.8. Upgrade recommended.

Reporter	Title	Published	Views	Family All 17
BDU FSTEC	The vulnerability in the Web Console management console for OSGi frameworks like Apache Felix allows a attacker to execute cross-site scripting attacks.	8 Aug 202500:00	–	bdu_fstec
Circl	CVE-2025-25247	10 Feb 202506:47	–	circl
CNNVD	Apache Felix Webconsole 跨站脚本漏洞	10 Feb 202500:00	–	cnnvd
CVE	CVE-2025-25247	10 Feb 202511:16	–	cve
IBM Security Bulletins	Security Bulletin: Due to use of apache.felix.webconsole, IBM webMethods BPM is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability	5 Mar 202614:23	–	ibm
IBM Security Bulletins	Security Bulletin: Due to use of apache.felix.webconsole, IBM webMethods BPM is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability	3 Feb 202609:04	–	ibm
EUVD	EUVD-2025-4096	3 Oct 202520:07	–	euvd
Github Security Blog	Apache Felix Webconsole: XSS in services console	10 Feb 202512:30	–	github
NVD	CVE-2025-25247	10 Feb 202512:15	–	nvd
OSV	GHSA-4C37-7M5H-C8M9 Apache Felix Webconsole: XSS in services console	10 Feb 202512:30	–	osv

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache Felix Webconsole",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "4.9.8",
        "status": "affected",
        "version": "Version 4.x",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "5.0.8",
        "status": "affected",
        "version": "Version 5.x",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
lists	www.lists.apache.org/thread/z47jbf0rbylzd0ktfzdw9c8b5fpyl24m

10 Feb 2025 11:16Current

EPSS0.00622

CWE-79