GitHub Advisoryadvisory · Maven

GHSA-9h9c-f287-c6vp Improper Control of Interaction Frequency in Apache syncope-core

MEDIUM Published 2018-11-06 Modified 2022-09-14 Official page ↗
Aliases
CVE-2018-17184
Ecosystem
Maven
Packages
org.apache.syncope:syncope-core
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-799
Reviewed
2020-06-16

Affected packages

• Maven org.apache.syncope:syncope-core: < 2.0.11 → fixed in 2.0.11 • Maven org.apache.syncope:syncope-core: >= 2.1.0, < 2.1.2 → fixed in 2.1.2

Description

A malicious user with enough administration entitlements can inject html-like elements containing JavaScript statements into Connector names, Report names, AnyTypeClass keys and Policy descriptions. When another user with enough administration entitlements edits one of the Entities above via Admin Console, the injected JavaScript code is executed.

Related

Alias · CVE (1)

  • CVE-2018-17184 A malicious user with enough administration entitlements can inject html-like elements containing JavaScript statements into Connector… vulnerability

Weakness · CWE (1)

  • CWE-799 Improper Control of Interaction Frequency weakness

References