diff --git a/advisories/github-reviewed/2025/02/GHSA-4c37-7m5h-c8m9/GHSA-4c37-7m5h-c8m9.json b/advisories/github-reviewed/2025/02/GHSA-4c37-7m5h-c8m9/GHSA-4c37-7m5h-c8m9.json new file mode 100644 index 00000000000..c01bb920c00 --- /dev/null +++ b/advisories/github-reviewed/2025/02/GHSA-4c37-7m5h-c8m9/GHSA-4c37-7m5h-c8m9.json @@ -0,0 +1,88 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4c37-7m5h-c8m9", + "modified": "2025-02-10T18:08:47Z", + "published": "2025-02-10T12:30:45Z", + "aliases": [ + "CVE-2025-25247" + ], + "summary": "Apache Felix Webconsole: XSS in services console", + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Felix Webconsole.\n\nThis issue affects Apache Felix Webconsole 4.x up to 4.9.8 and 5.x up to 5.0.8.\n\nUsers are recommended to upgrade to version 4.9.10 or 5.0.10 or higher, which fixes the issue.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.felix:org.apache.felix.webconsole" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.0.0" + }, + { + "fixed": "4.9.10" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.felix:org.apache.felix.webconsole" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "5.0.0" + }, + { + "fixed": "5.0.10" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-25247" + }, + { + "type": "WEB", + "url": "https://github.com/apache/felix-dev/commit/87513ea3533fdb79d9e2b251410bf2bfbd63941e" + }, + { + "type": "PACKAGE", + "url": "https://github.com/apache/felix-dev" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread/z47jbf0rbylzd0ktfzdw9c8b5fpyl24m" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2025/02/10/1" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-02-10T18:08:47Z", + "nvd_published_at": "2025-02-10T12:15:29Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-4c37-7m5h-c8m9/GHSA-4c37-7m5h-c8m9.json b/advisories/unreviewed/2025/02/GHSA-4c37-7m5h-c8m9/GHSA-4c37-7m5h-c8m9.json deleted file mode 100644 index 86f1af34f4d..00000000000 --- a/advisories/unreviewed/2025/02/GHSA-4c37-7m5h-c8m9/GHSA-4c37-7m5h-c8m9.json +++ /dev/null @@ -1,40 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-4c37-7m5h-c8m9", - "modified": "2025-02-10T15:32:19Z", - "published": "2025-02-10T12:30:45Z", - "aliases": [ - "CVE-2025-25247" - ], - "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Felix Webconsole.\n\nThis issue affects Apache Felix Webconsole 4.x up to 4.9.8 and 5.x up to 5.0.8.\n\nUsers are recommended to upgrade to version 4.9.10 or 5.0.10 or higher, which fixes the issue.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" - } - ], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-25247" - }, - { - "type": "WEB", - "url": "https://lists.apache.org/thread/z47jbf0rbylzd0ktfzdw9c8b5fpyl24m" - }, - { - "type": "WEB", - "url": "http://www.openwall.com/lists/oss-security/2025/02/10/1" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-79" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2025-02-10T12:15:29Z" - } -} \ No newline at end of file