CVE-2023-38435: Cross-site Scripting in healthcheck webconsole plugin

July 25, 2023 (updated February 13, 2025)

An improper neutralization of input during web page generation (‘Cross-site Scripting’) [CWE-79] vulnerability in Apache Felix Healthcheck Webconsole Plugin version 2.0.2 and prior may allow an attacker to perform a reflected cross-site scripting (XSS) attack.

Upgrade to Apache Felix Healthcheck Webconsole Plugin 2.1.0 or higher.

References

github.com/advisories/GHSA-4pvw-g9fx-594r
github.com/apache/felix-dev
github.com/apache/felix-dev/commit/c4e67520e0a4499389342491869919a6c42ed62c
lists.apache.org/thread/r3blhp3onr4rdbkgdyglqnccg0v79pfv
nvd.nist.gov/vuln/detail/CVE-2023-38435

Code Behaviors & Features

Detect and mitigate CVE-2023-38435 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →