PT-2025-12677 · Apache · Apache Vcl

Published 2025-03-24 · Updated 2025-03-27 · CVE-2024-53679

Positive Technologies (AI Summary)

CVSS v4.0

8.4

High

Base vector

AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/RE:M

Name of the Vulnerable Software and Affected Versions Apache VCL versions through 2.5.1

Description The issue is related to improper neutralization of input during web page generation, also known as 'Cross-site Scripting', in the User Lookup form of Apache VCL. A user with sufficient rights can craft a URL or be tricked into clicking a URL that will give a specified user elevated rights.

Recommendations For versions through 2.5.1, upgrade to version 2.5.2 to fix the issue. As a temporary workaround, consider restricting access to the User Lookup form until the upgrade is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-53679

Affected Products

Apache Vcl

References · 19

• https://osv.dev/vulnerability/CVE-2024-53679 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-53679 · Security Note
• https://lists.apache.org/thread/bq5vs0hndt9cz9b6rpfr5on1nd4qrmyr · Vendor Advisory
• https://twitter.com/CveFindCom/status/1904473678618009771 · Twitter Post
• https://t.me/cvetracker/19870 · Telegram Post
• https://t.me/cvedetector/21084 · Telegram Post
• https://twitter.com/TweetThreatNews/status/1905008747950243923 · Twitter Post
• https://twitter.com/cybercronai/status/1904643309936529657 · Twitter Post
• https://twitter.com/Dinosn/status/1904747734101270659 · Twitter Post
• https://t.me/cvenotify/116044 · Telegram Post
• http://openwall.com/lists/oss-security/2025/03/24/2 · Note
• https://twitter.com/oss_security/status/1904225496302248291 · Twitter Post
• https://twitter.com/the_yellow_fall/status/1904714927660785688 · Twitter Post
• https://twitter.com/samilaiho/status/1904964945554583760 · Twitter Post
• https://t.me/purp_sec/422 · Telegram Post