CVE-2025-25247 json
Apache Felix Webconsole: XSS in services console
published 2025-02-10 20 mo ago modified 2026-06-17 4 mo ago also GHSA-4c37-7m5h-c8m9 , EUVD-2025-4096
- cvss
- 6.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 53%
- public exploits
- 0
- none known
Summary
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Felix Webconsole.
This issue affects Apache Felix Webconsole 4.x up to 4.9.8 and 5.x up to 5.0.8.
Users are recommended to upgrade to version 4.9.10 or 5.0.10 or higher, which fixes the issue.
Patch / fix
- maven org.apache.felix:org.apache.felix.webconsole 4.9.10, 5.0.10
- apache felix_webconsole 4.9.10, 5.0.10
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2025-25247 updated
org.apache.felix.webconsole: Apache Felix Webconsole: XSS in services console
-
Red Hat Fuse 7 org.apache.felix/org.apache.felix.webconsole org.apache.felix/org.apache.felix.webconsoleaffected: workaround, no fix planned “Out of support scope”
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 20 mo ago
Exploit prediction
0.69% chance of exploitation in the next 30 days, higher than 53% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| CNA | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| GitHub | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.felix:org.apache.felix.webconsole | >=4.0.0, <4.9.10 >=5.0.0, <5.0.10 |
4.9.10 5.0.10 |
Affected products
- Apache Software Foundation Apache Felix Webconsole
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/apache/felix-dev/commit/87513ea3533fdb79d9e2b251410bf2bfbd63941e
web
-
lists.apache.org
/thread/z47jbf0rbylzd0ktfzdw9c8b5fpyl24m
vendor-advisory, web, issue-tracking, mailing-list
-
openwall.com
/lists/oss-security/2025/02/10/1
web, mailing-list, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-25247
advisory
-
github.com
/apache/felix-dev
package
Sources
- CVE List CVE-2025-25247
- GitHub Advisory GHSA-4c37-7m5h-c8m9
- NVD CVE-2025-25247
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.