Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS04cHh2LXg2anEtNXZ3Oc4AA-Ev

Apache Syncope Improper Input Validation vulnerability

When editing a user, group or any object in the Syncope Console, HTML tags could be added to any text field and could lead to potential exploits.
The same vulnerability was found in the Syncope Enduser, when editing "Personal Information" or "User Requests".

Users are recommended to upgrade to version 3.0.8, which fixes this issue.

Permalink: https://github.com/advisories/GHSA-8pxv-x6jq-5vw9
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS04cHh2LXg2anEtNXZ3Oc4AA-Ev
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: about 2 months ago
Updated: about 1 month ago

CVSS Score: 6.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Identifiers: GHSA-8pxv-x6jq-5vw9, CVE-2024-38503
References:

• https://nvd.nist.gov/vuln/detail/CVE-2024-38503
• https://syncope.apache.org/security#cve-2024-38503-html-tags-can-be-injected-into-console-or-enduser
• http://www.openwall.com/lists/oss-security/2024/07/22/3
• https://github.com/apache/syncope/commit/12e65f5fb12ad87ce0b223b3c2bb39025a4521e4
• https://github.com/apache/syncope/releases/tag/syncope-3.0.8
• https://github.com/advisories/GHSA-8pxv-x6jq-5vw9

Repository: https://github.com/apache/syncope
Blast Radius: 6.2

Affected Packages