CVE-2024-38503CWE-79

Apache Syncope: HTML tags can be injected into Console or Enduser text fields

Low · published July 22, 2024

CVSS v3.1
3.9
EPSS
1%
Percentile
52.9
In the wild
Unconfirmed
What it is

When editing a user, group or any object in the Syncope Console, HTML tags could be added to any text field and could lead to potential exploits.

The same vulnerability was found in the Syncope Enduser, when editing “Personal Information” or “User Requests”.

Users are recommended to upgrade to version 3.0.8, which fixes this issue.

The record
Technical detail
CVSS v3.1
3.9 · LOW
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00708 · 52.9th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2024-07-22T09:46Z
EPSS history
Timeline
  • 22 JUL 09:46Z
    Apache Syncope: HTML tags can be injected into Console or Enduser text fields
    cvelistv5