CVE-2019-17557: Cross-site scripting in Apache Syncope EndUser
Summary
CVE-2019-17557: Cross-site scripting in Apache Syncome EndUser. Affects org.apache.syncope.client:syncope-client-enduser across 2 version ranges.
< 2.0.15
>= 2.1.0, < 2.1.6
Fixed in 2.0.15 or 2.1.6, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Syncope EndUser is a user interface component of Apache Syncope, an open-source system for managing digital identities. It provides a web-based interface for end users to access and manage their own identity information. The vulnerability identified as CVE-2019-17557 allows an attacker to execute arbitrary JavaScript code on the EndUser UI login page by manipulating the successMessage parameter in the URL query string.
Vulnerability Detail
The vulnerability arises from a lack of proper input sanitization and validation in the EndUser UI login page. By injecting malicious JavaScript code into the successMessage parameter, an attacker can exploit this vulnerability to execute arbitrary code in the context of the victim's browser. This can lead to various security risks, including session hijacking, data theft, and unauthorized actions on behalf of the victim.
How To Fix
Latest published version: 2.1.14 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.0.152.0.15 -
>= 2.1.0, < 2.1.62.1.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can disable or restrict access to the EndUser UI login page until the upgrade to a patched version is completed. This can be achieved by modifying the server configuration or implementing access control rules to block unauthorized access to the vulnerable page.
Conclusion
The CVE-2019-17557 vulnerability in Apache Syncope EndUser exposes users to the risk of cross-site scripting attacks. It is crucial for users to upgrade to the patched versions of Apache Syncope EndUser (2.0.15 or 2.1.6) to ensure the security of their systems. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.syncope.client:syncope-client-enduser →
FAQ
Apache Syncope is an open-source system for managing digital identities. It provides features for user provisioning, access control, and identity management.
Apache Syncope EndUser is a user interface component of Apache Syncope that allows end users to access and manage their own identity information.
Cross-site scripting is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to various attacks, such as session hijacking, data theft, and defacement of websites.
An attacker can exploit this vulnerability by manipulating the successMessage parameter in the URL query string of the EndUser UI login page. By injecting malicious JavaScript code, the attacker can execute arbitrary code in the victim's browser.
Yes, a fix is available in Apache Syncope EndUser versions 2.0.15 and 2.1.6. Users are advised to upgrade to these versions to mitigate the vulnerability.
