Skip to content
CVE PROGRAM SOURCE RECORD3.9 Low

CVE-2024-38503

Apache Syncope: HTML tags can be injected into Console or Enduser text fields

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
apache

Description

When editing a user, group or any object in the Syncope Console, HTML tags could be added to any text field and could lead to potential exploits. The same vulnerability was found in the Syncope Enduser, when editing “Personal Information” or “User Requests”. Users are recommended to upgrade to version 3.0.8, which fixes this issue.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Apache Software Foundation Apache Syncope

Default version status: unaffected

  • 2.1 to ≤ 2.1.14affected
  • 3.0 to ≤ 3.0.7affected

References