CVE-2025-27867: Apache Felix HTTP Webconsole Plugin: XSS in HTTP Webconsole Plugin

March 12, 2025 (updated March 21, 2025)

Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Apache Felix HTTP Webconsole Plugin.

This issue affects Apache Felix HTTP Webconsole Plugin: from Version 1.X through 1.2.0.

Users are recommended to upgrade to version 1.2.2, which fixes the issue.

References

github.com/advisories/GHSA-2cv6-4f2r-jq2c
github.com/apache/felix-dev
lists.apache.org/thread/y83f2rvm8bccr5ctgv7mzxd69p6f77dp
nvd.nist.gov/vuln/detail/CVE-2025-27867

Code Behaviors & Features

Detect and mitigate CVE-2025-27867 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →