Medium severity · published Oct 24, 2024
CVE-2024-45031
Apache Syncope: Stored XSS in Console and Enduser
6.1
CVSS
0.7%
EPSS
No
On KEV
Description
When editing objects in the Syncope Console, incomplete HTML tags could be used to bypass HTML sanitization. This made it possible to inject stored XSS payloads which would trigger for other users during ordinary usage of the application.
XSS payloads could also be injected in Syncope Enduser when editing “Personal Information” or “User Requests”: such payloads would trigger for administrators in Syncope Console, thus enabling session hijacking.
Users are recommended to upgrade to version 3.0.9, which fixes this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AS
Apache Syncope · Apache Software Foundation
2.1 through 2.1.14; 3.0 through 3.0.8 · source: vendor
SY
Syncope · Apache
2.1.0 before 3.0.9 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-45031
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-45031
Mailing List
https://lists.apache.org/thread/fn567pfmo3s55ofkc42drz8b4kgbhp9m
Mailing List
http://www.openwall.com/lists/oss-security/2024/10/24/2
More from Apache Syncope
9.8
CVE-2026-73370
Apache Syncope: Cross-Realm boundaries reconciliation bypass
9.8
CVE-2026-73470
Apache Syncope: Delegating users can grant unowned Roles
9.8
CVE-2026-73579
Apache Syncope: Non-recursive Any search could skip Realms restrictions
9.8
CVE-2026-75030
Apache Syncope: Incomplete authorization checks for Group members deprovisioning
9.8
CVE-2026-77051
Apache Syncope: SQL injection via unsanitized entityKey and opEvent in Audit Events search