Security advisories

PageSeeder uses third-party components and libraries, including Apache Tomcat and other open-source software. Security vulnerabilities are regularly reported in these dependencies, but not all vulnerabilities affect PageSeeder or can be exploited in a PageSeeder installation.

Allette Systems reviews relevant security vulnerabilities to assess their potential impact on supported PageSeeder versions.

This page documents our assessments of publicly disclosed vulnerabilities, their applicability to PageSeeder, and any recommended actions or mitigations.

Published advisories

The following table lists security vulnerabilities we have assessed. Select an advisory for details about the vulnerability, our assessment and any recommended action.

Select an advisory for details about the vulnerability, our assessment and any recommended action.

* historical releases not independently assessed.

Understanding vulnerability status

Each advisory includes a status classification:

• Affected: PageSeeder is affected by the vulnerability. Review the advisory for recommended actions, available mitigations or fixed versions.
• Not affected: The vulnerability does not affect the specified PageSeeder versions in the configurations described in the advisory.
• Under investigation: We are evaluating the vulnerability and have not yet determined whether PageSeeder is affected.
• Fixed: The vulnerability has been addressed in the specified PageSeeder version or later.

These assessments are specific to the PageSeeder versions and configurations identified in each advisory. Custom deployments, modified components or independently managed dependencies may require additional assessment.

Scope of the advisories

These advisories focus on vulnerabilities that Allette Systems considers relevant to PageSeeder's security.

They may include vulnerabilities in third-party dependencies even when our assessment indicates PageSeeder is not affected, particularly where clarification may help administrators interpret vulnerability scanner results.

This is not an exhaustive list of all vulnerabilities affecting PageSeeder dependencies. The absence of a CVE from this page does not indicate it has been assessed or that PageSeeder is unaffected.

Advisories reflect information available at the time of assessment and may be updated as new information becomes available.

Additional resources

• PageSeeder release notes
• PageSeeder installation and configuration guide
• Apache Tomcat Security Advisories 
• CVE Program 
• CISA Known Exploited Vulnerabilities Catalog 
• Allette Systems Vulnerability Disclosure Policy