CVE-2008-6879
Apache Roller 2.3, 3.0, 3.1, 4.0 - Cross-Site Scripting via Search q Parameter
Title source: llmDescription
Cross-site scripting (XSS) vulnerability in Apache Roller 2.3, 3.0, 3.1, and 4.0 allows remote attackers to inject arbitrary web script or HTML via the q parameter in a search action.
References (5)
Core 5
Core References
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/31523
Third Party Advisory, VDB Entry vdb-entry
x_refsource_osvdb
http://osvdb.org/51151
Patch x_refsource_confirm
http://svn.apache.org/viewvc?view=rev&revision=668737
Patch vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/33110
Patch, Vendor Advisory x_refsource_confirm
http://issues.apache.org/roller/browse/ROL-1766
Scores
EPSS
0.0499
EPSS Percentile
91.3%
Details
CWE
CWE-79
Status
published
Products (4)
apache/roller
2.3
apache/roller
3.0
apache/roller
3.1
apache/roller
4.0
Published
Jul 30, 2009
Tracked Since
Feb 18, 2026