Apache Roller
14 CVEs affecting Apache Roller. Latest disclosed: 2025-04-14. Critical: 2, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-17198 | Critical | 9.8 | 2019-05-28 | Server-side Request Forgery (SSRF) and File Enumeration vulnerability in Apache Roller 5.2.1, 5.2.0 and earlier unsupported versions relies on Java SAX Parser… |
CVE-2014-0030 | Critical | 9.8 | 2017-10-10 | The XML-RPC protocol support in Apache Roller before 5.0.3 allows attackers to conduct XML External Entity (XXE) attacks via unspecified vectors. |
CVE-2025-24859 | High | 8.8 | 2025-04-14 | A session management vulnerability exists in Apache Roller before version 6.1.5 where active user sessions are not properly invalidated after password changes… |
CVE-2021-33580 | High | 7.5 | 2021-08-18 | User controlled `request.getHeader("Referer")`, `request.getRequestURL()` and `request.getQueryString()` are used to build and run a regex expression. The atta… |
CVE-2015-0249 | High | 7.2 | 2017-07-17 | The weblog page template in Apache Roller 5.1 through 5.1.1 allows remote authenticated users with admin privileges for a weblog to execute arbitrary Java code… |
CVE-2019-0234 | Medium | 6.1 | 2019-07-15 | A Reflected Cross-site Scripting (XSS) vulnerability exists in Apache Roller. Roller's Math Comment Authenticator did not property sanitize user input and coul… |
CVE-2024-25090 | Medium | 5.4 | 2024-07-26 | Insufficient input validation and sanitation in Profile name & screenname, Bookmark name & description and blogroll name features in all versions of Apache Rol… |
CVE-2023-37581 | Medium | 5.4 | 2023-08-06 | Insufficient input validation and sanitation in Weblog Category name, Website About and File Upload features in all versions of Apache Roller on all platforms… |
CVE-2024-46911 | Medium | 4.7 | 2024-10-14 | Cross-site Resource Forgery (CSRF), Privilege escalation vulnerability in Apache Roller. On multi-blog/user Roller websites, by default weblog owners are trust… |
CVE-2013-4212 | | 2013-12-07 | Certain getText methods in the ActionSupport controller in Apache Roller before 5.0.2 allow remote attackers to execute arbitrary OGNL expressions via the firs… | |
CVE-2013-4171 | | 2013-12-07 | Multiple cross-site scripting (XSS) vulnerabilities in Apache Roller before 5.0.2 allow remote attackers to inject arbitrary web script or HTML via vectors rel… | |
CVE-2012-2381 | | 2012-06-26 | Multiple cross-site scripting (XSS) vulnerabilities in Apache Roller before 5.0.1 allow remote authenticated users to inject arbitrary web script or HTML by le… | |
CVE-2012-2380 | | 2012-06-26 | Multiple cross-site request forgery (CSRF) vulnerabilities in the admin/editor console in Apache Roller before 5.0.1 allow remote attackers to hijack the authe… | |
CVE-2008-6879 | | 2009-07-30 | Cross-site scripting (XSS) vulnerability in Apache Roller 2.3, 3.0, 3.1, and 4.0 allows remote attackers to inject arbitrary web script or HTML via the q param… |