CVE-2025-24854
BaseFortify
Publication date: 2025-07-31
Last updated on: 2025-11-04
Assigner: Apache Software Foundation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| apache | jspwiki | to 2.12.3 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
Upgrade Apache JSPWiki to version 2.12.3 or later to mitigate the XSS vulnerability triggered by the Image plugin.
Can you explain this vulnerability to me?
This vulnerability is a cross-site scripting (XSS) issue in Apache JSPWiki triggered by a specially crafted request using the Image plugin. It allows an attacker to execute JavaScript code in the victim's browser, potentially stealing sensitive information.
How can this vulnerability impact me? :
The vulnerability can impact you by enabling attackers to run malicious JavaScript in your browser when using Apache JSPWiki, which could lead to theft of sensitive information or session hijacking.