Kasper Karlsson

**Name of the Vulnerable Software and Affected Versions** Apache Syncope versions 3.0 through 3.0.15 Apache Syncope versions 4.0 through 4.0.3 **Description** A reflected cross-site scripting (XSS) issue exists in the Enduser Login page of Apache Syncope. An attacker could potentially steal user credentials by tricking a legitimate user into clicking a malicious link and logging into Syncope Enduser. The attack involves manipulating the login process to execute malicious scripts within the context of a user's browser. **Recommendations** Upgrade to version 3.0.16 Upgrade to version 4.0.4

**Name of the Vulnerable Software and Affected Versions** Syncope versions prior to 3.0.9 **Description** The issue allows an attacker to bypass HTML sanitization by using incomplete HTML tags when editing objects in the Syncope Console. This enables the injection of stored XSS payloads, which can trigger for other users during normal application usage. Additionally, XSS payloads can be injected in Syncope Enduser when editing "Personal Information" or "User Requests", and these payloads can trigger for administrators in Syncope Console, allowing session hijacking. **Recommendations** For versions prior to 3.0.9, upgrade to version 3.0.9 to fix the issue. As a temporary workaround, consider restricting the editing of objects in the Syncope Console and limiting access to the "Personal Information" and "User Requests" sections in Syncope Enduser to minimize the risk of exploitation.