Security Bulletin: Due to use of apache.felix.webconsole, IBM webMethods BPM is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability

Summary IBM webMethods BPM is using apache.felix.webconsole. Vulnerability Details CVEID:CVE-2025-25247 DESCRIPTION: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache Felix Webconsole. This issue affects Apache Felix Webconsole 4.x up to...

CVE-2025-25247

A flaw was found in the Apache Felix Webconsole. This vulnerability allows Cross-site Scripting XSS via improper neutralization of input during web page generation. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product...

CVE-2025-25247

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache Felix Webconsole. This issue affects Apache Felix Webconsole 4.x up to 4.9.8 and 5.x up to 5.0.8. Users are recommended to upgrade to version 4.9.10 or 5.0.10 or higher, which fixes the issu...

CVE-2025-25247

Apache Felix Webconsole (versions 4.x up to 4.9.8 and 5.x up to 5.0.8) is vulnerable to Cross-site Scripting (XSS) due to the improper neutralization of user-supplied input during web page generation. Specifically, the renderContent() function in ServicesServlet.java fails to validate or escape i...

CVE-2025-25247 Apache Felix Webconsole: XSS in services console

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache Felix Webconsole. This issue affects Apache Felix Webconsole 4.x up to 4.9.8 and 5.x up to 5.0.8. Users are recommended to upgrade to version 4.9.10 or 5.0.10 or higher, which fixes the issu...