Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2024-38503

Good to know:

icon

Date: July 22, 2024

When editing a user, group or any object in the Syncope Console, HTML tags could be added to any text field and could lead to potential exploits. The same vulnerability was found in the Syncope Enduser, when editing “Personal Information” or “User Requests”. Users are recommended to upgrade to version 3.0.8, which fixes this issue.

Language: Java

Severity Score

Related Resources (8)

https://github.com/apache/syncope/releases/tag/syncope-3.0.8
https://syncope.apache.org/security#cve-2024-38503-html-tags-can-be-injected-into-console-or-enduser
http://www.openwall.com/lists/oss-security/2024/07/22/3
https://github.com/apache/syncope
https://www.openwall.com/lists/oss-security/2024/07/22/3
https://nvd.nist.gov/vuln/detail/CVE-2024-38503
https://github.com/apache/syncope/commit/12e65f5fb12ad87ce0b223b3c2bb39025a4521e4
https://www.mend.io/vulnerability-database/CVE-2024-38503

Severity Score

Weakness Type (CWE)

Cross-Site Scripting (XSS)

CWE-79

Input Validation

CWE-20

Top Fix

icon

Upgrade Version

Upgrade to version org.apache.syncope.client.idrepo:syncope-client-idrepo-console:3.0.8

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): LOW
User Interaction (UI): REQUIRED
Scope (S): CHANGED
Confidentiality (C): LOW
Integrity (I): LOW
Availability (A): NONE

Do you need more information?

Contact Us