CVE-2024-45031

MEDIUM

Apache Syncope 2.1.0-3.0.8 - Stored Cross-Site Scripting via Incomplete HTML Tag Bypass

Title source: llm
STIX 2.1

Description

When editing objects in the Syncope Console, incomplete HTML tags could be used to bypass HTML sanitization. This made it possible to inject stored XSS payloads which would trigger for other users during ordinary usage of the application. XSS payloads could also be injected in Syncope Enduser when editing “Personal Information” or “User Requests”: such payloads would trigger for administrators in Syncope Console, thus enabling session hijacking. Users are recommended to upgrade to version 3.0.9, which fixes this issue.

References (2)

Core 2
Core References
Mailing List, Vendor Advisory vendor-advisory
https://lists.apache.org/thread/fn567pfmo3s55ofkc42drz8b4kgbhp9m
Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/10/24/2

Scores

CVSS v3 6.1
EPSS 0.0253
EPSS Percentile 85.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (2)
apache/syncope 2.1.0 - 3.0.9
org.apache.syncope.client/syncope-client-console 2.1.0Maven
Published Oct 24, 2024
Tracked Since Feb 18, 2026