Security Bulletin: Due to use of apache.felix.webconsole, IBM webMethods BPM is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability

Summary IBM webMethods BPM is using apache.felix.webconsole. Vulnerability Details CVEID:CVE-2025-25247 DESCRIPTION: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache Felix Webconsole. This issue affects Apache Felix Webconsole 4.x up to...

CVE-2025-25247

A flaw was found in the Apache Felix Webconsole. This vulnerability allows Cross-site Scripting XSS via improper neutralization of input during web page generation. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product...

org.apache.felix:org.apache.felix.webconsole.plugins.ds (=2.3.0), org.apache.felix:org.apache.felix.webconsole.plugins.memoryusage (=1.1.0) +2 more potentially affected by CVE-2025-25247 via org.apache.felix:org.apache.felix.webconsole (=4.9.0)

org.apache.felix:org.apache.felix.webconsole MAVEN version =4.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.felix:org.apache.felix.webconsole and may be impacted: - org.apache.felix:org.apache.felix.webconsole.plugins.ds =2.3.0 -...

biz.aQute:biz.aQute.openapi.debug (=1.3.0), biz.aQute:biz.aQute.openapi.example.petstore (=1.3.0) +110 more potentially affected by CVE-2025-25247 via org.apache.felix:org.apache.felix.webconsole (>=4.0.0 <=4.9.0)

org.apache.felix:org.apache.felix.webconsole MAVEN version =4.0.0, =1.0.0.Final, =1.0.0.Final, =1.5, =1.0.0, =3.2.5, =1.0.2, =1.0.1, =1.0.5 and more Source cves: CVE-2025-25247 Source advisory: OSV:GHSA-4C37-7M5H-C8M9...

CVE-2025-25247

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache Felix Webconsole. This issue affects Apache Felix Webconsole 4.x up to 4.9.8 and 5.x up to 5.0.8. Users are recommended to upgrade to version 4.9.10 or 5.0.10 or higher, which fixes the issu...

CVE-2025-25247

Apache Felix Webconsole CVE-2025-25247 is a Cross-site Scripting (XSS) vulnerability caused by improper neutralization of input during web page generation. Itffects Apache Felix Webconsole with 4.x up to 4.9.8 and 5.x up to 5.0.8. The CVSS v3.1 base score is 6.1 (Network attack vector, no privile...

CVE-2025-25247 Apache Felix Webconsole: XSS in services console

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache Felix Webconsole. This issue affects Apache Felix Webconsole 4.x up to 4.9.8 and 5.x up to 5.0.8. Users are recommended to upgrade to version 4.9.10 or 5.0.10 or higher, which fixes the issu...