Threats tagged 'ghsa-xwqc-wpw7-xxrq'

Apache Roller versions 4.0 through 6.1.6 contain a vulnerability that allows a weblog administrator to access another user's stored password hash by creating a custom weblog template. This occurs because the template can access the underlying persistent objects directly through a public accessor, bypassing intended data wrappers. The issue affects any weblog where the administrator can author templates without requiring non-default configurations. Upgrading to Apache Roller 6.1.7 or later resolves this issue by removing template access to the underlying wrapped objects.