CVE-2024-38503

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-38503
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-38503.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-38503
Aliases
Published
2024-07-22T09:46:39.285Z
Modified
2026-07-15T02:12:05.804219864Z
Severity
  • 3.9 (Low) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N CVSS Calculator
Summary
Apache Syncope: HTML tags can be injected into Console or Enduser text fields
Details

When editing a user, group or any object in the Syncope Console, HTML tags could be added to any text field and could lead to potential exploits. The same vulnerability was found in the Syncope Enduser, when editing “Personal Information” or “User Requests”.

Users are recommended to upgrade to version 3.0.8, which fixes this issue.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/38xxx/CVE-2024-38503.json",
    "cwe_ids": [
        "CWE-79"
    ],
    "cna_assigner": "apache",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "2.1"
                },
                {
                    "last_affected": "2.1.14"
                },
                {
                    "introduced": "3.0"
                },
                {
                    "last_affected": "3.0.7"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/apache/syncope

Affected ranges

Type
GIT
Repo
https://github.com/apache/syncope
Events
Introduced
49c2e53ba6baf1423a89b5ab9a24aa665a5780ad
Last affected
84ed68fb63cb05a723a90325aee8d2a2f081b4eb
Introduced
d4a8b1eb53b246c42acb757739637be02838a082
Fixed
9975401d9e53ea7a1c85bac0c9bf3814c5f5a113
Database specific 
{
    "extracted_events": [
        {
            "introduced": "2.1.0"
        },
        {
            "last_affected": "2.1.14"
        },
        {
            "introduced": "3.0.0"
        },
        {
            "fixed": "3.0.8"
        }
    ],
    "cpe": "cpe:2.3:a:apache:syncope:*:*:*:*:*:*:*:*",
    "source": "CPE_RANGE"
}

Affected versions

syncope-2.*
syncope-2.1.0
syncope-2.1.1
syncope-2.1.10
syncope-2.1.11
syncope-2.1.12
syncope-2.1.13
syncope-2.1.14
syncope-2.1.2
syncope-2.1.3
syncope-2.1.4
syncope-2.1.5
syncope-2.1.6
syncope-2.1.7
syncope-2.1.8
syncope-2.1.9
syncope-3.*
syncope-3.0.0
syncope-3.0.1
syncope-3.0.2
syncope-3.0.3
syncope-3.0.4
syncope-3.0.5
syncope-3.0.6
syncope-3.0.7

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-38503.json"