CVE-2024-45031

Katalog CVE

CVSS 6.1 · Medium EPSS 0,71%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada apache syncope. Skor CVSS 3.1 6.1 (Medium) menurut CISA ADP.

Deskripsi (NVD)

When editing objects in the Syncope Console, incomplete HTML tags could be used to bypass HTML sanitization. This made it possible to inject stored XSS payloads which would trigger for other users during ordinary usage of the application. XSS payloads could also be injected in Syncope Enduser when editing “Personal Information” or “User Requests”: such payloads would trigger for administrators in Syncope Console, thus enabling session hijacking. Users are recommended to upgrade to version 3.0.9, which fixes this issue.

Rincian

Terbit di NVD

24 Oktober 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.1 (Medium), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,71% peluang dieksploitasi; lebih tinggi dari 52,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/fn567pfmo3s55ofkc42drz8b4kgbhp9m mailing list · advisory vendor
• http://www.openwall.com/lists/oss-security/2024/10/24/2 mailing list · advisory pihak ketiga