PT-2024-31384 · Syncope · Syncope

Kasper Karlsson + 1 · Published 2024-10-24 · Updated 2025-09-01 · CVE-2024-45031

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Syncope versions prior to 3.0.9

Description The issue allows an attacker to bypass HTML sanitization by using incomplete HTML tags when editing objects in the Syncope Console. This enables the injection of stored XSS payloads, which can trigger for other users during normal application usage. Additionally, XSS payloads can be injected in Syncope Enduser when editing "Personal Information" or "User Requests", and these payloads can trigger for administrators in Syncope Console, allowing session hijacking.

Recommendations For versions prior to 3.0.9, upgrade to version 3.0.9 to fix the issue. As a temporary workaround, consider restricting the editing of objects in the Syncope Console and limiting access to the "Personal Information" and "User Requests" sections in Syncope Enduser to minimize the risk of exploitation.

Fix

XSS

RCE

Weakness Enumeration

CWE-79

CWE-20

Related Identifiers

CVE-2024-45031

GHSA-JMRF-85G8-X8XV

Affected Products

Syncope

References · 14

• https://osv.dev/vulnerability/CVE-2024-45031 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-45031 · Security Note
• https://lists.apache.org/thread/fn567pfmo3s55ofkc42drz8b4kgbhp9m · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jmrf-85g8-x8xv · Vendor Advisory
• https://github.com/apache/syncope · Note
• https://github.com/apache/syncope/commit/0c620a9eda2c0927875c129ebae66d2ea94f3e6a · Note
• https://github.com/apache/syncope/commit/f80d3f6cfbd71acb03ece0f7601f660ee0be7e74 · Note
• https://t.me/cvedetector/8803 · Telegram Post
• https://t.me/cvenotify/99372 · Telegram Post
• https://t.me/cvenotify/128464 · Telegram Post
• https://t.me/cvenotify/102540 · Telegram Post
• https://syncope.apache.org/security#cve-2024-45031-apache-syncope-stored-xss-in-console-and-enduser · Note
• https://t.me/cveNotify/134032 · Telegram Post
• http://openwall.com/lists/oss-security/2024/10/24/2 · Note