CVE-2023-37581

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2023-37581

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-37581.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2023-37581

Published

2023-08-06T08:15:09.013Z

Modified

2026-04-10T04:58:45.361042Z

Severity

5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

[none]

Details

Insufficient input validation and sanitation in Weblog Category name, Website About and File Upload features in all versions of Apache Roller on all platforms allows an authenticated user to perform an XSS attack. Mitigation: if you do not have Roller configured for untrusted users, then you need to do nothing because you trust your users to author raw HTML and other web content. If you are running with untrusted users then you should upgrade to Roller 6.1.2 and you should disable Roller's File Upload feature.

References

Affected packages

Git / github.com/apache/roller

Affected ranges

Type

GIT

Repo

https://github.com/apache/roller

Events

Introduced

Fixed

700a03b88c10c966c318ad30ced0e911a5d62798

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "6.1.2"
        }
    ]
}

Affected versions

roller-5.*

roller-5.1.2

roller-5.2.0-final

roller-5.2.3-rc-3

roller-6.*

roller-6.0.0

roller-6.0.0-rc-3

roller-6.0.1

roller-6.1.0

roller-6.1.1-rc2

roller-6.1.2rc1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-37581.json"