From c146d20f7cdd89e74ce9b8c2b3cccba4fc698755 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Fri, 26 Jul 2024 09:31:57 +0000
Subject: [PATCH] Publish GHSA-g9rf-qc6j-h2f7

---
 .../GHSA-g9rf-qc6j-h2f7.json                  | 35 +++++++++++++++++++
 1 file changed, 35 insertions(+)
 create mode 100644 advisories/unreviewed/2024/07/GHSA-g9rf-qc6j-h2f7/GHSA-g9rf-qc6j-h2f7.json

diff --git a/advisories/unreviewed/2024/07/GHSA-g9rf-qc6j-h2f7/GHSA-g9rf-qc6j-h2f7.json b/advisories/unreviewed/2024/07/GHSA-g9rf-qc6j-h2f7/GHSA-g9rf-qc6j-h2f7.json
new file mode 100644
index 00000000000..7b826f67e8e
--- /dev/null
+++ b/advisories/unreviewed/2024/07/GHSA-g9rf-qc6j-h2f7/GHSA-g9rf-qc6j-h2f7.json
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-g9rf-qc6j-h2f7",
+  "modified": "2024-07-26T09:30:31Z",
+  "published": "2024-07-26T09:30:31Z",
+  "aliases": [
+    "CVE-2024-25090"
+  ],
+  "details": "Insufficient input validation and sanitation in Profile name & screenname, Bookmark name & description and blogroll name features in all versions of Apache Roller on all platforms allows an authenticated user to perform an XSS attack. Mitigation: if you do not have Roller configured for untrusted users, then you need to do nothing because you trust your users to author raw HTML and other web content. If you are running with untrusted users then you should upgrade to Roller 6.1.3.\n\nThis issue affects Apache Roller: from 5.0.0 before 6.1.3.\n\nUsers are recommended to upgrade to version 6.1.3, which fixes the issue.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25090"
+    },
+    {
+      "type": "WEB",
+      "url": "https://lists.apache.org/thread/lb50jqyxwf8jrfpydl6dc5zpqtpgrrwd"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-20"
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-26T09:15:09Z"
+  }
+}
\ No newline at end of file