PT-2024-28040 · Syncope+1 · Syncope+2

Published 2024-07-22 · Updated 2024-12-06 · CVE-2024-38503

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Syncope versions prior to 3.0.8

Description The issue allows HTML tags to be added to any text field when editing a user, group, or object in the Syncope Console, potentially leading to exploits. The same vulnerability is found in the Syncope Enduser when editing "Personal Information" or "User Requests".

Recommendations For versions prior to 3.0.8, upgrade to version 3.0.8 to fix the issue. As a temporary workaround, consider restricting the ability to add HTML tags to text fields in the Syncope Console and Syncope Enduser until the upgrade is applied.

Fix

XSS

RCE

Weakness Enumeration

CWE-79

CWE-20

Related Identifiers

CVE-2024-38503

GHSA-8PXV-X6JQ-5VW9

Affected Products

Syncope

Syncope Console

Syncope Enduser

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2024-38503 · Security Note
• https://syncope.apache.org/security#cve-2024-38503-html-tags-can-be-injected-into-console-or-enduser · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-38503 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8pxv-x6jq-5vw9 · Vendor Advisory
• https://github.com/apache/syncope · Note
• https://github.com/apache/syncope/releases/tag/syncope-3.0.8 · Note
• https://github.com/apache/syncope/commit/12e65f5fb12ad87ce0b223b3c2bb39025a4521e4 · Note
• http://openwall.com/lists/oss-security/2024/07/22/3 · Note
• https://t.me/cvenotify/103425 · Telegram Post
• https://t.me/cvenotify/93976 · Telegram Post
• https://t.me/cvedetector/1409 · Telegram Post
• https://openwall.com/lists/oss-security/2024/07/22/3 · Note
• https://t.me/cvenotify/87037 · Telegram Post