CVE-2024-45031

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-45031
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-45031.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-45031
Aliases
Published
2024-10-24T14:21:35.279Z
Modified
2026-08-12T03:51:09.361044610Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
Apache Syncope: Stored XSS in Console and Enduser
Details

When editing objects in the Syncope Console, incomplete HTML tags could be used to bypass HTML sanitization. This made it possible to inject stored XSS payloads which would trigger for other users during ordinary usage of the application. XSS payloads could also be injected in Syncope Enduser when editing “Personal Information” or “User Requests”: such payloads would trigger for administrators in Syncope Console, thus enabling session hijacking.

Users are recommended to upgrade to version 3.0.9, which fixes this issue.

Database specific 
{
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45031.json",
    "cna_assigner": "apache",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "2.1"
                },
                {
                    "last_affected": "2.1.14"
                },
                {
                    "introduced": "3.0"
                },
                {
                    "last_affected": "3.0.8"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/apache/syncope

Affected ranges

Type
GIT
Repo
https://github.com/apache/syncope
Events
Introduced
49c2e53ba6baf1423a89b5ab9a24aa665a5780ad
Fixed
44dd536d7994c07644f1cd0e113d396a6f867714
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:apache:syncope:*:*:*:*:*:*:*:*",
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "2.1.0"
        },
        {
            "fixed": "3.0.9"
        }
    ]
}

Affected versions

syncope-2.*
syncope-2.1.0
syncope-3.*
syncope-3.0.0
syncope-3.0.0-M0
syncope-3.0.0-M1
syncope-3.0.0-M2
syncope-3.0.1
syncope-3.0.2
syncope-3.0.3
syncope-3.0.4
syncope-3.0.5
syncope-3.0.6
syncope-3.0.7
syncope-3.0.8

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-45031.json"