CVE-2024-38503: Apache Syncope Improper Input Validation vulnerability
Summary
CVE-2024-38503: Apache Syncope Improper Input Validation vulnerability. Affects org.apache.syncope.client.idrepo:syncope-client-idrepo-common-ui versions >= 2.1.0, < 3.0.8. Fixed in 3.0.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Syncope is an open-source system for managing digital identities in enterprise environments. It provides a comprehensive set of features for user and group management, access control, and provisioning. The Syncope Console and Syncope Enduser are web-based interfaces that allow administrators and end-users to interact with the system. These interfaces are built using the org.apache.syncope.client.idrepo:syncope-client-idrepo-common-ui and org.apache.syncope.client.idrepo:syncope-client-idrepo-console packages, respectively.
Vulnerability Detail
The Apache Syncope Console and Syncope Enduser are vulnerable to an Improper Input Validation issue. When editing a user, group, or any object in the Syncope Console, HTML tags can be added to any text field, potentially leading to exploits. The same vulnerability exists in the Syncope Enduser when editing 'Personal Information' or 'User Requests'. An attacker could inject malicious HTML tags, leading to cross-site scripting (XSS) attacks or other security breaches. This vulnerability has a CVSS score of 6.5.
How To Fix
Minimum fixed version
3.0.8
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading to version 3.0.8 of the affected packages.
Conclusion
The Apache Syncope Console and Syncope Enduser are vulnerable to an Improper Input Validation issue, which allows for the injection of malicious HTML tags. Upgrading to version 3.0.8 of the affected packages is recommended to fix this vulnerability.
See every vulnerability recorded for org.apache.syncope.client.idrepo:syncope-client-idrepo-common-ui →
FAQ
Apache Syncope is an open-source system for managing digital identities in enterprise environments. It provides features for user and group management, access control, and provisioning.
This vulnerability allows an attacker to inject malicious HTML tags, potentially leading to cross-site scripting (XSS) attacks or other security breaches.
To fix this vulnerability, upgrade to version 3.0.8 of the affected packages: org.apache.syncope.client.idrepo:syncope-client-idrepo-common-ui and org.apache.syncope.client.idrepo:syncope-client-idrepo-console.
There is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading to version 3.0.8 of the affected packages.
The CVSS score of this vulnerability is 6.5.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.syncope.client.idrepo:syncope-client-idrepo-common-ui.
