Alerts
Critical Vulnerability in Apache Roller
16 April 2025
Apache Software Foundation has released updates addressing a critical vulnerability affecting their Apache Roller. Users and administrators of the affected product versions are advised to update to the latest versions immediately.
Apache Software Foundation has released updates addressing a critical vulnerability (CVE-2025-24859) affecting their Apache Roller open-source, a Java-based blogging server software. The vulnerability has a Common Vulnerability Scoring System (CVSSv4.0) score of 2.1* out of 10. The CVSSv4.0 has been updated as of 18 April 2025.
Successful exploitation of the session management vulnerability could allow an attacker to retain access to the application even after the user's password has been changed, which may potentially allow persistent unauthorised access if the credentials were previously compromised.
This vulnerability affects Apache Roller versions prior to version 6.1.5.
Users and administrators of the affected product versions are advised to update to the latest versions immediately.
More information available here:
https://lists.apache.org/thread/4j906k16v21kdx8hk87gl7663sw7lg7f
https://nvd.nist.gov/vuln/detail/CVE-2025-24859
https://thehackernews.com/2025/04/critical-apache-roller-vulnerability.html