Apache Roller, an open-source blog server platform developed in the Java programming language, allows users and administrators to create, manage, and publish multiple personal or group blogs on the same server. Recently, on its website, Apache Roller announced a critical security vulnerability, scoring 10.0 on the CVSS 4.0 scale—the highest in severity, affecting all versions of Apache Roller up to and including 6.1.4. Below are the details:

Details

• Vulnerability Identifier: CVE-2025-24859

• CVSS Score (4.0): 10.0

• Severity Level: Critical

• Description: The vulnerability exists in the session management mechanism of Apache Roller. Specifically, after a user changes their password, the active sessions are not terminated, leading to a vulnerability that allows an attacker to use the current active session to log in and access the application without going through authentication.

• Affected Versions: All versions prior to 6.1.5

CVE-2025-24859 is extremely critical because it can be easily exploited if an attacker already has the login information or has stolen a valid user session. It allows the attacker to maintain long-term access to the application, despite any changes the user makes to their login information. This results in security risks, unauthorized data access, and the potential for data theft and leakage of sensitive information.

Mitigation & Recommendations

In Apache Roller version 6.1.5, the development team has patched the vulnerability by implementing centralized session management. This mechanism ensures that active sessions are immediately terminated if a user changes their password or if the user account is disabled. Therefore, the FPT Threat Intelligence team recommends that users:

• Update Apache Roller: Upgrade to version 6.1.5 and later to patch the vulnerability.

• Manage Active Sessions: If you cannot immediately apply the patch, users and administrators should monitor and manage existing active sessions. Implement temporary measures to terminate active sessions when there is a change in the user's account status (such as a password change or account deactivation).

• Regular Security Checks: Conduct regular security assessments to identify and address existing vulnerabilities in the system.

• Enhance User Awareness: Increase user awareness about security in general. Additionally, users should strictly follow policies related to setting and regularly changing passwords, as well as reporting and terminating unusual login sessions in the application.

References

1. CVE Record: CVE-2025-24859