Lucene search

GoogleOSV:CVE-2024-38379

HistoryJun 22, 2024 - 9:15 a.m.

CVE-2024-38379

2024-06-2209:15:09

Google

osv.dev

apache allura

neighborhood settings

stored xss

vulnerability

version 1.17.1

CVSS3

4.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

AI Score

5.8

Confidence

High

JSON

Apache Allura’s neighborhood settings are vulnerable to a stored XSS attack. Only neighborhood admins can access these settings, so the scope of risk is limited to configurations where neighborhood admins are not fully trusted.

This issue affects Apache Allura: from 1.4.0 through 1.17.0.

Users are recommended to upgrade to version 1.17.1, which fixes the issue.

References

lists.apache.org/thread/2lb6vp00sj2b2snpmhff5lyortxjsnrp