PT-2018-13940 · Apache+2 · Apache Syncope+2

Published 2018-11-06 · Updated 2018-12-13 · CVE-2018-17184

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions No specific software or versions mentioned

Description A malicious user with sufficient administration entitlements can inject html-like elements containing JavaScript statements into various fields, such as Connector names, Report names, AnyTypeClass keys, and Policy descriptions. When another user with sufficient administration entitlements edits one of these entities via the Admin Console, the injected JavaScript code is executed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-799

CWE-79

Related Identifiers

CVE-2018-17184

GHSA-9H9C-F287-C6VP

Affected Products

Apache Syncope

Org.Apache.Syncope:Syncope-Core

Syncope

References · 5

• https://syncope.apache.org/security#CVE-2018-17184:_Stored_XSS · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9h9c-f287-c6vp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-17184 · Security Note
• https://osv.dev/vulnerability/CVE-2018-17184 · Vendor Advisory
• https://github.com/advisories/GHSA-9h9c-f287-c6vp · Note