CVE-2024-38379

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-38379
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-38379.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-38379
Published
2024-06-22T09:09:32.464Z
Modified
2026-08-12T03:51:40.989784222Z
Severity
  • 4.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
Apache Allura: Stored authenticated XSS
Details

Apache Allura's neighborhood settings are vulnerable to a stored XSS attack.  Only neighborhood admins can access these settings, so the scope of risk is limited to configurations where neighborhood admins are not fully trusted.

This issue affects Apache Allura: from 1.4.0 through 1.17.0.

Users are recommended to upgrade to version 1.17.1, which fixes the issue.

Database specific 
{
    "cna_assigner": "apache",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "1.4.0"
                },
                {
                    "last_affected": "1.17.0"
                }
            ],
            "source": "AFFECTED_FIELD"
        },
        {
            "source": "DESCRIPTION",
            "extracted_events": [
                {
                    "introduced": "1.4.0"
                },
                {
                    "fixed": "1.17.0"
                }
            ]
        }
    ],
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/38xxx/CVE-2024-38379.json"
}
References

Affected packages

Git / github.com/apache/allura

Affected ranges

Type
GIT
Repo
https://github.com/apache/allura
Events
Introduced
1ffd75eb78df895f05ae22fc9c5ed4262d04c285
Fixed
75e520f923c87f65026ff034e6da69d10f8d97a9
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:apache:allura:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "1.4.0"
        },
        {
            "fixed": "1.17.1"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

rel/1.*
rel/1.10.0
rel/1.11.0
rel/1.11.1
rel/1.12.0
rel/1.13.0
rel/1.14.0
rel/1.15.0
rel/1.16.0
rel/1.17.0
rel/1.4.0
rel/1.5.0
rel/1.6.0
rel/1.7.0
rel/1.8.0
rel/1.8.1
rel/1.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-38379.json"