PT-2018-13940 · Apache+2 · Apache Syncope+2

Publicado 2018-11-06 · Atualizado 2018-12-13 · CVE-2018-17184

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions No specific software or versions mentioned

Description A malicious user with sufficient administration entitlements can inject html-like elements containing JavaScript statements into various fields, such as Connector names, Report names, AnyTypeClass keys, and Policy descriptions. When another user with sufficient administration entitlements edits one of these entities via the Admin Console, the injected JavaScript code is executed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-799

CWE-79

Identificadores relacionados

CVE-2018-17184

GHSA-9H9C-F287-C6VP

Produtos afetados

Apache Syncope

Org.Apache.Syncope:Syncope-Core

Syncope

Referências · 5

• https://syncope.apache.org/security#CVE-2018-17184:_Stored_XSS · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-9h9c-f287-c6vp · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-17184 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-17184 · Aviso do Fabricante
• https://github.com/advisories/GHSA-9h9c-f287-c6vp · Nota