CVE-2024-38503
Medium
Description
When editing a user, group or any object in the Syncope Console, HTML tags could be added to any text field and could lead to potential exploits. The same vulnerability was found in the Syncope Enduser, when editing “Personal Information” or “User Requests”. Users are recommended to upgrade to version 3.0.8, which fixes this issue.
SeverityMedium
CVSS5.4
Exploit probability—
Product
Apache Syncope
PublishedJul 22, 2024
First seenJul 22, 2024
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- apache syncope3.0.8 or later
- org.apache.syncope.client.idrepo:syncope-client-idrepo-common-ui3.0.8 or later
- org.apache.syncope.client.idrepo:syncope-client-idrepo-console3.0.8 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache syncope | 2.1.0 ≤ v ≤ 2.1.14, 3.0.0 ≤ v < 3.0.8 | 3.0.8 |
| org.apache.syncope.client.idrepo:syncope-client-idrepo-common-uiMaven | 2.1.0 ≤ v < 3.0.8 | 3.0.8 |
| org.apache.syncope.client.idrepo:syncope-client-idrepo-consoleMaven | 2.1.0 ≤ v < 3.0.8 | 3.0.8 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.