Apache Roller vulnerabilities

14 CVEs affecting Apache Roller, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-24859, published 2025-04-14.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2013-4212, published 2013-12-07. Medium severity, CVSS 6.8. EPSS: 81.1% chance of exploitation in the next 30 days. Certain getText methods in the ActionSupport controller in Apache Roller before 5.0.2 allow remote attackers to execute arbitrary OGNL expressions via the first or second parameter, as demonstrated…
CVE-2014-0030, published 2017-10-10. Critical severity, CVSS 9.8. EPSS: 16.9% chance of exploitation in the next 30 days. The XML-RPC protocol support in Apache Roller before 5.0.3 allows attackers to conduct XML External Entity (XXE) attacks via unspecified vectors.
CVE-2008-6879, published 2009-07-30. Medium severity, CVSS 4.3. EPSS: 5% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in Apache Roller 2.3, 3.0, 3.1, and 4.0 allows remote attackers to inject arbitrary web script or HTML via the q parameter in a search action.
CVE-2015-0249, published 2017-07-17. High severity, CVSS 7.2. EPSS: 4.6% chance of exploitation in the next 30 days. The weblog page template in Apache Roller 5.1 through 5.1.1 allows remote authenticated users with admin privileges for a weblog to execute arbitrary Java code via crafted Velocity Text Language (aka…
CVE-2018-17198, published 2019-05-28. Critical severity, CVSS 9.8. EPSS: 4.1% chance of exploitation in the next 30 days. Server-side Request Forgery (SSRF) and File Enumeration vulnerability in Apache Roller 5.2.1, 5.2.0 and earlier unsupported versions relies on Java SAX Parser to implement its XML-RPC interface and…
CVE-2019-0234, published 2019-07-15. Medium severity, CVSS 6.1. EPSS: 3.4% chance of exploitation in the next 30 days. A Reflected Cross-site Scripting (XSS) vulnerability exists in Apache Roller. Roller's Math Comment Authenticator did not property sanitize user input and could be exploited to perform Reflected…
CVE-2021-33580, published 2021-08-18. High severity, CVSS 7.5. EPSS: 3.3% chance of exploitation in the next 30 days. User controlled `request.getHeader("Referer")`, `request.getRequestURL()` and `request.getQueryString()` are used to build and run a regex expression. The attacker doesn't have to use a browser and…
CVE-2013-4171, published 2013-12-07. Medium severity, CVSS 4.3. EPSS: 3% chance of exploitation in the next 30 days. Multiple cross-site scripting (XSS) vulnerabilities in Apache Roller before 5.0.2 allow remote attackers to inject arbitrary web script or HTML via vectors related to the search results in the (1)…
CVE-2012-2381, published 2012-06-26. Low severity, CVSS 3.5. EPSS: 2.5% chance of exploitation in the next 30 days. Multiple cross-site scripting (XSS) vulnerabilities in Apache Roller before 5.0.1 allow remote authenticated users to inject arbitrary web script or HTML by leveraging the blogger role.
CVE-2012-2380, published 2012-06-26. Medium severity, CVSS 6.8. EPSS: 1.6% chance of exploitation in the next 30 days. Multiple cross-site request forgery (CSRF) vulnerabilities in the admin/editor console in Apache Roller before 5.0.1 allow remote attackers to hijack the authentication of admins or editors by…

Latest

CVE-2025-24859, published 2025-04-14. High severity, CVSS 8.8. EPSS: 1.1% chance of exploitation in the next 30 days. A session management vulnerability exists in Apache Roller before version 6.1.5 where active user sessions are not properly invalidated after password changes. When a user's password is changed,…
CVE-2024-46911, published 2024-10-14. Medium severity, CVSS 4.7. EPSS: 0.4% chance of exploitation in the next 30 days. Cross-site Resource Forgery (CSRF), Privilege escalation vulnerability in Apache Roller. On multi-blog/user Roller websites, by default weblog owners are trusted to publish arbitrary weblog content…
CVE-2024-25090, published 2024-07-26. Medium severity, CVSS 5.4. EPSS: 0.8% chance of exploitation in the next 30 days. Insufficient input validation and sanitation in Profile name & screenname, Bookmark name & description and blogroll name features in all versions of Apache Roller on all platforms allows an…
CVE-2023-37581, published 2023-08-06. Medium severity, CVSS 5.4. EPSS: 1.2% chance of exploitation in the next 30 days. Insufficient input validation and sanitation in Weblog Category name, Website About and File Upload features in all versions of Apache Roller on all platforms allows an authenticated user to perform…