Apache
Apache Roller: vulnerabilidades y CVE
Apache Roller tiene 32 vulnerabilidades publicadas, 18 de ellas en los últimos 12 meses. 5 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE32
Últimos 12 meses18
Críticas5
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-86507 | Media (6.1) | 0.40% | — | 28 sept 2026 | Improper neutralization of input in Apache Roller 6.1.5 allows an anonymous remote attacker to store a crafted comment-author URL that can execute script in the session of a weblog moderator or global administrator when… |
| CVE-2026-91206 | Media (6.1) | 0.40% | — | 28 sept 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a remote attacker to perform reflected cross-site scripting through the optional LDAP comment… |
| CVE-2026-91204 | Media (6.1) | 0.40% | — | 28 sept 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows an anonymous remote attacker to store a comment containing a javascript: URI link that survives HTML… |
| CVE-2026-82546 | Media (6.1) | 0.28% | — | 28 sept 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows an unauthenticated remote attacker to store a crafted comment-author URL through the incoming Trackback… |
| CVE-2026-82387 | Media (5.4) | 0.18% | — | 28 sept 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a user with media-upload rights to store active content on Roller's origin, because the media upload… |
| CVE-2026-82386 | Alta (7.7) | 0.29% | — | 28 sept 2026 | Improper Restriction of XML External Entity Reference in Apache Roller 6.1.5 allows a weblog administrator to read files readable by the Roller process and reach internal network addresses by importing a crafted OPML… |
| CVE-2026-82385 | Media (6.5) | 0.28% | — | 28 sept 2026 | Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 6.1.5 allows a weblog administrator to read files on the application classpath, including Roller configuration files containing secrets, by… |
| CVE-2026-82384 | Crítica (9.8) | 0.77% | — | 28 sept 2026 | Deserialization of Untrusted Data in Apache Roller 6.1.5 allows an unauthenticated remote attacker to cause deserialization of attacker-controlled bytes, because the XML-RPC endpoint accepts vendor extension types that… |
| CVE-2026-82383 | Alta (8.2) | 0.49% | — | 28 sept 2026 | Missing Authentication for Critical Function in Apache Roller 6.1.5 allows an unauthenticated remote attacker to persistently change a site-global configuration value (the frontpage weblog selection) on any installed… |
| CVE-2026-82382 | Media (6.1) | 0.25% | — | 28 sept 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a remote attacker to perform reflected cross-site scripting against a visitor to a weblog using the… |
| CVE-2026-82381 | Media (5.4) | 0.18% | — | 28 sept 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a user with authoring rights on a weblog to store crafted content that is later written into the… |
| CVE-2026-82380 | Alta (8.1) | 0.28% | — | 28 sept 2026 | Cross-Site Request Forgery (CSRF) in Apache Roller 6.1.5 allows a remote attacker to cause a logged-in user to perform state-changing actions under the victim's authority, because the CSRF validation filters accept a… |
| CVE-2026-82379 | Alta (7.7) | 0.37% | — | 28 sept 2026 | Authentication Bypass by Capture-replay in Apache Roller 6.1.5 allows an attacker who captures a valid WSSE digest authentication header to replay it and gain the victim's AtomPub authority, because the authentication… |
| CVE-2026-82378 | Crítica (9) | 0.42% | — | 28 sept 2026 | Incorrect Authorization in the OAuth 1.0a authorization endpoint of Apache Roller 6.1.5 allows an unauthenticated remote attacker who learns an outstanding request token for a configured site-wide consumer to bind that… |
| CVE-2026-82377 | Crítica (9.9) | 0.53% | — | 28 sept 2026 | Missing Authorization in Apache Roller 6.1.5 allows an authenticated user to read, modify, or delete weblog content belonging to other weblogs through the legacy XML-RPC Blogger and MetaWeblog APIs, because the handlers… |
| CVE-2026-82376 | Alta (7.7) | 0.30% | — | 28 sept 2026 | Improper Restriction of XML External Entity Reference in Apache Roller 6.1.5 allows a user with entry-editing rights on a weblog to cause the server to parse an attacker-influenced trackback response with an XML parser… |
| CVE-2026-82375 | Alta (7.4) | 0.37% | — | 28 sept 2026 | Server-Side Request Forgery (SSRF) in Apache Roller 6.1.5 allows an authenticated user with entry-editing rights on a weblog to cause outbound HTTP requests to attacker-chosen destinations through legacy outbound… |
| CVE-2026-82348 | Alta (7.7) | 0.36% | — | 28 sept 2026 | Authorization Bypass Through User-Controlled Key in Apache Roller 6.1.5 allows an authenticated user with authoring rights on one weblog to read, modify, or delete resources belonging to another weblog through unscoped… |
| CVE-2025-24859 | Baja (2.1) | 1.1% | — | 14 abr 2025 | A session management vulnerability exists in Apache Roller before version 6.1.5 where active user sessions are not properly invalidated after password changes. When a user's password is changed, either by the user… |
| CVE-2024-46911 | Media (4.7) | 0.45% | — | 14 oct 2024 | Cross-site Resource Forgery (CSRF), Privilege escalation vulnerability in Apache Roller. On multi-blog/user Roller websites, by default weblog owners are trusted to publish arbitrary weblog content and this combined… |
| CVE-2024-25090 | Media (5.4) | 0.75% | — | 26 jul 2024 | Insufficient input validation and sanitation in Profile name & screenname, Bookmark name & description and blogroll name features in all versions of Apache Roller on all platforms allows an authenticated user to perform… |
| CVE-2023-37581 | Media (5.4) | 1.2% | — | 6 ago 2023 | Insufficient input validation and sanitation in Weblog Category name, Website About and File Upload features in all versions of Apache Roller on all platforms allows an authenticated user to perform an XSS attack.… |
| CVE-2021-33580 | Alta (7.5) | 3.3% | — | 18 ago 2021 | User controlled `request.getHeader("Referer")`, `request.getRequestURL()` and `request.getQueryString()` are used to build and run a regex expression. The attacker doesn't have to use a browser and may send a specially… |
| CVE-2019-0234 | Media (6.1) | 3.4% | — | 15 jul 2019 | A Reflected Cross-site Scripting (XSS) vulnerability exists in Apache Roller. Roller's Math Comment Authenticator did not property sanitize user input and could be exploited to perform Reflected Cross Site Scripting… |
| CVE-2018-17198 | Crítica (9.8) | 4.1% | — | 28 may 2019 | Server-side Request Forgery (SSRF) and File Enumeration vulnerability in Apache Roller 5.2.1, 5.2.0 and earlier unsupported versions relies on Java SAX Parser to implement its XML-RPC interface and by default that… |
| CVE-2014-0030 | Crítica (9.8) | 17% | — | 10 oct 2017 | The XML-RPC protocol support in Apache Roller before 5.0.3 allows attackers to conduct XML External Entity (XXE) attacks via unspecified vectors. |
| CVE-2015-0249 | Alta (7.2) | 4.6% | — | 17 jul 2017 | The weblog page template in Apache Roller 5.1 through 5.1.1 allows remote authenticated users with admin privileges for a weblog to execute arbitrary Java code via crafted Velocity Text Language (aka VTL). |
| CVE-2013-4212 | Media (6.8) | 81% | — | 7 dic 2013 | Certain getText methods in the ActionSupport controller in Apache Roller before 5.0.2 allow remote attackers to execute arbitrary OGNL expressions via the first or second parameter, as demonstrated by the pageTitle… |
| CVE-2013-4171 | Media (4.3) | 3.0% | — | 7 dic 2013 | Multiple cross-site scripting (XSS) vulnerabilities in Apache Roller before 5.0.2 allow remote attackers to inject arbitrary web script or HTML via vectors related to the search results in the (1) RSS and (2) Atom feed… |
| CVE-2012-2381 | Baja (3.5) | 2.5% | — | 26 jun 2012 | Multiple cross-site scripting (XSS) vulnerabilities in Apache Roller before 5.0.1 allow remote authenticated users to inject arbitrary web script or HTML by leveraging the blogger role. |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.