CVE-2024-38503

Katalog CVE

CVSS 5.4 · Medium EPSS 0,71%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada apache syncope. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

When editing a user, group or any object in the Syncope Console, HTML tags could be added to any text field and could lead to potential exploits. The same vulnerability was found in the Syncope Enduser, when editing “Personal Information” or “User Requests”. Users are recommended to upgrade to version 3.0.8, which fixes this issue.

Rincian

Terbit di NVD

22 Juli 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,71% peluang dieksploitasi; lebih tinggi dari 52,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://syncope.apache.org/security#cve-2024-38503-html-tags-can-be-injected-into-console-or-enduser advisory vendor
• https://www.openwall.com/lists/oss-security/2024/07/22/3
• http://www.openwall.com/lists/oss-security/2024/07/22/3