CVE-2023-38435

MEDIUM

Apache Felix Healthcheck Webconsole Plugin <2.1.0 - XSS

Title source: llm
STIX 2.1

Description

An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Apache Felix Healthcheck Webconsole Plugin version 2.0.2 and prior may allow an attacker to perform a reflected cross-site scripting (XSS) attack. Upgrade to Apache Felix Healthcheck Webconsole Plugin 2.1.0 or higher.

References (3)

Core 3
Core References
Mailing List, Not Applicable, Third Party Advisory
http://seclists.org/fulldisclosure/2023/Jul/43
Mailing List vendor-advisory mailing-list
https://lists.apache.org/thread/r3blhp3onr4rdbkgdyglqnccg0v79pfv

Scores

CVSS v3 6.1
EPSS 0.0137
EPSS Percentile 80.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (2)
apache/felix_health_check_webconsole_plugin < 2.1.0
org.apache.felix/org.apache.felix.healthcheck.webconsoleplugin 0 - 2.1.0Maven
Published Jul 25, 2023
Tracked Since Feb 18, 2026