CVE-2015-0249
HighSummary
The weblog page template in Apache Roller versions 5.1 through 5.1.1 allows remote authenticated users with admin privileges for a weblog to execute arbitrary Java code via crafted Velocity Text Language (aka VTL).
Risk Assessment
Exploitation of this vulnerability could lead to remote code execution, posing a serious threat to the integrity and security of the system.
Recommendation
It is recommended to upgrade to the latest version of Apache Roller to mitigate this vulnerability and to restrict access to administrative functions to trusted users.
Other vulnerabilities in Apache Roller
See all- CVE-2014-0030Critical
The XML-RPC protocol support in Apache Roller before 5.0.3 allows attackers to conduct XML External Entity (XXE) attacks via unspecified vectors.
- CVE-2023-37581Medium
All versions of Apache Roller have insufficient input validation and sanitation in the category name, website about, and file upload features, allowing an authenticated user to perform an XSS attack.
Original NVD description (English source)
The weblog page template in Apache Roller 5.1 through 5.1.1 allows remote authenticated users with admin privileges for a weblog to execute arbitrary Java code via crafted Velocity Text Language (aka VTL).