GitHub Advisoryadvisory · Maven
GHSA-jmrf-85g8-x8xv Apache Syncope: Stored XSS in Console and Enduser
MEDIUM
Official page ↗
- Aliases
- CVE-2024-45031
- Ecosystem
- Maven
- Packages
- org.apache.syncope.client:syncope-client-console
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weaknesses
- CWE-20, CWE-79
- Reviewed
- 2024-10-24
Affected packages
• Maven org.apache.syncope.client:syncope-client-console: >= 2.1.0, <= 2.1.14 (no fix yet)
Description
When editing objects in the Syncope Console, incomplete HTML tags could be used to bypass HTML sanitization. This made it possible to inject stored XSS payloads which would trigger for other users during ordinary usage of the application.
XSS payloads could also be injected in Syncope Enduser when editing “Personal Information” or “User Requests”: such payloads would trigger for administrators in Syncope Console, thus enabling session hijacking.
Users are recommended to upgrade to version 3.0.9, which fixes this issue.
Related
Alias · CVE (1)
- CVE-2024-45031 When editing objects in the Syncope Console, incomplete HTML tags could be used to bypass HTML sanitization. vulnerability
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-45031 advisory
- https://github.com/apache/syncope/commit/0c620a9eda2c0927875c129ebae66d2ea94f3e6a web
- https://github.com/apache/syncope/commit/f80d3f6cfbd71acb03ece0f7601f660ee0be7e74 web
- https://github.com/apache/syncope package
- https://lists.apache.org/thread/fn567pfmo3s55ofkc42drz8b4kgbhp9m web
- https://syncope.apache.org/security#cve-2024-45031-apache-syncope-stored-xss-in-console-and-enduser web
- http://www.openwall.com/lists/oss-security/2024/10/24/2 web