CVE-2019-17557

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2019-17557
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-17557.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2019-17557
Aliases
Published
2020-05-04T13:15:11.657Z
Modified
2026-07-08T17:16:48.408033Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

It was found that the Apache Syncope EndUser UI login page prio to 2.0.15 and 2.1.6 reflects the successMessage parameters. By this mean, a user accessing the Enduser UI could execute javascript code from URL query string.

References

Affected packages

Git / github.com/apache/syncope

Affected ranges

Type
GIT
Repo
https://github.com/apache/syncope
Events
Introduced
973afc777d2f8093785875c62e808d97334fb2e3
Fixed
ed7a41d182bd30cc9881e1a39da2d7a1658a6067
Introduced
49c2e53ba6baf1423a89b5ab9a24aa665a5780ad
Fixed
a1200e18daccb3deebcdaaf91c965596df10cab7
Database specific 
{
    "cpe": "cpe:2.3:a:apache:syncope:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "2.0.0"
        },
        {
            "fixed": "2.0.15"
        },
        {
            "introduced": "2.1.0"
        },
        {
            "fixed": "2.1.6"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

syncope-2.*
syncope-2.0.0
syncope-2.0.1
syncope-2.0.10
syncope-2.0.11
syncope-2.0.12
syncope-2.0.13
syncope-2.0.14
syncope-2.0.2
syncope-2.0.3
syncope-2.0.4
syncope-2.0.5
syncope-2.0.6
syncope-2.0.7
syncope-2.0.8
syncope-2.0.9
syncope-2.1.0
syncope-2.1.1
syncope-2.1.2
syncope-2.1.3
syncope-2.1.4
syncope-2.1.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-17557.json"