CVE-2023-37581 Apache Roller: Roller's weblog category, weblog settings and file-upload features did not properly sanitize input could be exploited to perform Reflected Cross Site Scripting (XSS) even on a Roller site configured for untrusted users.

🗓️ 06 Aug 2023 07:21:04Reported by GoogleType

osv🔗 osv.dev👁 22 Views

Insufficient input validation in Apache Roller allows authenticated XSS attack. Mitigation: upgrade to Roller 6.1.2 & disable File Upload

Reporter	Title	Published	Views	Family All 9
Circl	CVE-2023-37581	6 Aug 202312:12	–	circl
CNNVD	Apache Roller Cross-Site Scripting Vulnerability	6 Aug 202300:00	–	cnnvd
CVE	CVE-2023-37581	6 Aug 202307:21	–	cve
Cvelist	CVE-2023-37581 Apache Roller: Roller's weblog category, weblog settings and file-upload features did not properly sanitize input could be exploited to perform Reflected Cross Site Scripting (XSS) even on a Roller site configured for untrusted users.	6 Aug 202307:21	–	cvelist
EUVD	EUVD-2023-41466	3 Oct 202520:07	–	euvd
NVD	CVE-2023-37581	6 Aug 202308:15	–	nvd
Prion	Input validation	6 Aug 202308:15	–	prion
Positive Technologies	PT-2023-26031 · Apache · Apache Roller	6 Aug 202300:00	–	ptsecurity
Vulnrichment	CVE-2023-37581 Apache Roller: Roller's weblog category, weblog settings and file-upload features did not properly sanitize input could be exploited to perform Reflected Cross Site Scripting (XSS) even on a Roller site configured for untrusted users.	6 Aug 202307:21	–	vulnrichment

Source	Link
openwall	www.openwall.com/lists/oss-security/2023/08/16/1
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2023/37xxx/CVE-2023-37581.json
lists	www.lists.apache.org/thread/n9mjhhlm7z7b7to646tkvf3otkf21flp
nvd	www.nvd.nist.gov/vuln/detail/CVE-2023-37581

15 Jul 2026 01:48Current

6Medium risk

Vulners AI Score6

CVSS 3.15.4

EPSS0.00911

SSVC