{"cve":"CVE-2024-25090","nvd":{"published":"2024-07-26T09:15:09.700","modified":"2026-06-17T07:15:29.367","status":"Modified","description":"Insufficient input validation and sanitation in Profile name & screenname, Bookmark name & description and blogroll name features in all versions of Apache Roller on all platforms allows an authenticated user to perform an XSS attack. Mitigation: if you do not have Roller configured for untrusted users, then you need to do nothing because you trust your users to author raw HTML and other web content. If you are running with untrusted users then you should upgrade to Roller 6.1.3.\n\nThis issue affects Apache Roller: from 5.0.0 before 6.1.3.\n\nUsers are recommended to upgrade to version 6.1.3, which fixes the issue.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","score":5.4},"cwes":["CWE-20","CWE-79"],"references":["https://lists.apache.org/thread/lb50jqyxwf8jrfpydl6dc5zpqtpgrrwd","http://www.openwall.com/lists/oss-security/2024/07/25/2","https://lists.apache.org/thread/lb50jqyxwf8jrfpydl6dc5zpqtpgrrwd"],"products":["apache:roller"],"source":"nvd","synced_at":"2026-10-19T21:52:42.518321223+00:00"},"epss":{"cve":"CVE-2024-25090","score":0.00752,"percentile":0.5504,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}