Threats tagged 'ghsa-jm23-4q7g-qcr4'

Apache Roller versions 4.0 through 6.1.6 are affected by a cross-site scripting (XSS) vulnerability. This occurs because blogroll links imported from OPML files were not properly validated or escaped, allowing a weblog administrator to store malicious scripts that execute in visitors' browsers. The issue is addressed in Apache Roller 6.1.7 and later, which restricts imported links to web links only and escapes them on output.