Apache Apache Roller
7 CVEs affecting Apache Apache Roller. Latest disclosed: 2025-04-14. Critical: 1, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-17198 | Critical | 9.8 | 2019-05-28 | Server-side Request Forgery (SSRF) and File Enumeration vulnerability in Apache Roller 5.2.1, 5.2.0 and earlier unsupported versions relies on Java SAX Parser… |
CVE-2025-24859 | High | 8.8 | 2025-04-14 | A session management vulnerability exists in Apache Roller before version 6.1.5 where active user sessions are not properly invalidated after password changes… |
CVE-2021-33580 | High | 7.5 | 2021-08-18 | User controlled `request.getHeader("Referer")`, `request.getRequestURL()` and `request.getQueryString()` are used to build and run a regex expression. The atta… |
CVE-2019-0234 | Medium | 6.1 | 2019-07-15 | A Reflected Cross-site Scripting (XSS) vulnerability exists in Apache Roller. Roller's Math Comment Authenticator did not property sanitize user input and coul… |
CVE-2024-25090 | Medium | 5.4 | 2024-07-26 | Insufficient input validation and sanitation in Profile name & screenname, Bookmark name & description and blogroll name features in all versions of Apache Rol… |
CVE-2023-37581 | Medium | 5.4 | 2023-08-06 | Insufficient input validation and sanitation in Weblog Category name, Website About and File Upload features in all versions of Apache Roller on all platforms… |
CVE-2024-46911 | Medium | 4.7 | 2024-10-14 | Cross-site Resource Forgery (CSRF), Privilege escalation vulnerability in Apache Roller. On multi-blog/user Roller websites, by default weblog owners are trust… |