Medium severity · published Jun 22, 2024
CVE-2024-38379
Apache Allura: Stored authenticated XSS
4.8
CVSS
0.7%
EPSS
No
On KEV
Description
Apache Allura's neighborhood settings are vulnerable to a stored XSS attack. Only neighborhood admins can access these settings, so the scope of risk is limited to configurations where neighborhood admins are not fully trusted.
This issue affects Apache Allura: from 1.4.0 through 1.17.0.
Users are recommended to upgrade to version 1.17.1, which fixes the issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AA
Apache Allura · Apache Software Foundation
1.4.0 through 1.17.0 · source: vendor
AL
Allura · Apache
1.4.0 before 1.17.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-38379
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-38379
Vendor Advisory
https://lists.apache.org/thread/2lb6vp00sj2b2snpmhff5lyortxjsnrp
www.openwall.com
http://www.openwall.com/lists/oss-security/2024/06/21/1
More from Apache Allura
9.8
CVE-2026-73240
Apache Allura: Git command injection
9.1
CVE-2026-92120
Apache Allura: Oauth1 Replay Attack
9.1
CVE-2026-92119
Apache Allura: REST API Mass Assignment
9.1
CVE-2026-92116
Apache Allura: OAuth1 missing callback validation
9.1
CVE-2026-80181
Apache Allura: Server-side request forgery