Threats tagged 'ghsa-jq4j-xm3m-rwf8'

Apache Roller versions 6.1.2 through 6.1.6 contain a cross-site scripting (XSS) vulnerability. This flaw allows a weblog administrator to store malicious script code that executes in the browsers of weblog members when they open their main menu. The vulnerability arises because the HTML-stripping routine fails to close a tag and the weblog description is rendered without proper escaping. Users are advised to upgrade to Apache Roller 6.1.7 or later to address this issue.