GitHub Advisory DatabaseGHSA-8PXV-X6JQ-5VW9Apache Syncope Improper Input Validation vulnerability
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
AI Score
Confidence
High
EPSS
Percentile
27.3%
When editing a user, group or any object in the Syncope Console, HTML tags could be added to any text field and could lead to potential exploits.
The same vulnerability was found in the Syncope Enduser, when editing “Personal Information” or “User Requests”.
Users are recommended to upgrade to version 3.0.8, which fixes this issue.
Affected configurations
| Vendor | Product | Version | CPE |
|---|---|---|---|
| * | org.apache.syncope.client.idrepo\ | syncope-client-idrepo-console | cpe:2.3:a:*:org.apache.syncope.client.idrepo\:syncope-client-idrepo-console:*:*:*:*:*:*:*:* |
| * | org.apache.syncope.client.idrepo\ | syncope-client-idrepo-common-ui | cpe:2.3:a:*:org.apache.syncope.client.idrepo\:syncope-client-idrepo-common-ui:*:*:*:*:*:*:*:* |
References
www.openwall.com/lists/oss-security/2024/07/22/3
github.com/advisories/GHSA-8pxv-x6jq-5vw9
github.com/apache/syncope/commit/12e65f5fb12ad87ce0b223b3c2bb39025a4521e4
github.com/apache/syncope/releases/tag/syncope-3.0.8
nvd.nist.gov/vuln/detail/CVE-2024-38503
syncope.apache.org/security#cve-2024-38503-html-tags-can-be-injected-into-console-or-enduser
www.openwall.com/lists/oss-security/2024/07/22/3
Related
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
AI Score
Confidence
High
EPSS
Percentile
27.3%