Cross-site scripting in Apache Syncome EndUser

2022-01-0619:38:07

Google

osv.dev

0.001 Low

EPSS

Percentile

40.0%

JSON

It was found that the Apache Syncope EndUser UI login page prio to 2.0.15 and 2.1.6 reflects the successMessage parameters. By this mean, a user accessing the Enduser UI could execute javascript code from URL query string.

CPENameOperatorVersion
org.apache.syncope.client:syncope-client-endusereq2.0.1
org.apache.syncope.client:syncope-client-endusereq2.0.6
org.apache.syncope.client:syncope-client-endusereq2.0.0-M4
org.apache.syncope.client:syncope-client-endusereq2.0.13
org.apache.syncope.client:syncope-client-endusereq2.1.0
org.apache.syncope.client:syncope-client-endusereq2.0.0-M3
org.apache.syncope.client:syncope-client-endusereq2.1.1
org.apache.syncope.client:syncope-client-endusereq2.0.0.M5
org.apache.syncope.client:syncope-client-endusereq2.0.2
org.apache.syncope.client:syncope-client-endusereq2.0.5

Name	Operator	Version
org.apache.syncope.client:syncope-client-enduser	eq	2.0.1
org.apache.syncope.client:syncope-client-enduser	eq	2.0.6
org.apache.syncope.client:syncope-client-enduser	eq	2.0.0-M4
org.apache.syncope.client:syncope-client-enduser	eq	2.0.13
org.apache.syncope.client:syncope-client-enduser	eq	2.1.0
org.apache.syncope.client:syncope-client-enduser	eq	2.0.0-M3
org.apache.syncope.client:syncope-client-enduser	eq	2.1.1
org.apache.syncope.client:syncope-client-enduser	eq	2.0.0.M5
org.apache.syncope.client:syncope-client-enduser	eq	2.0.2
org.apache.syncope.client:syncope-client-enduser	eq	2.0.5