CVE-2019-17557 - It was found that the Apache Syncope EndUser UI login page prio to 2.0.15 and 2.1.6 reflects the successMessage parameters

Back Back to CVE browser

LOW

It was found that the Apache Syncope EndUser UI login page prio to 2.0.15 and 2.1.6 reflects the successMessage parameters

Published May 4, 2020

5.4

LOW

CVSS 3.1

EPSS 1.23%

Description

It was found that the Apache Syncope EndUser UI login page prio to 2.0.15 and 2.1.6 reflects the successMessage parameters. By this mean, a user accessing the Enduser UI could execute javascript code from URL query string.

Affected products

Vendor n/a Product Apache Syncope Default
n/a
- Version
  Apache Syncope 2.0.X releases prior to 2.0.15, 2.1.X releases prior to 2.1.6
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Apache Syncope

n/a

Version	Status	Constraints
Apache Syncope 2.0.X releases prior to 2.0.15, 2.1.X releases prior to 2.1.6	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (4)

http://syncope.apache.org/security
x_refsource_MISCVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-0485
Advisory
https://github.com/advisories/GHSA-6qj8-c27w-rp33
Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-17557

Link	Providers	Tags
http://syncope.apache.org/security		x_refsource_MISCVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-0485		Advisory
https://github.com/advisories/GHSA-6qj8-c27w-rp33		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-17557