Cross-site scripting in Apache Syncome EndUser
Low severity
GitHub Reviewed
Published
Jan 6, 2022
to the GitHub Advisory Database
•
Updated Feb 1, 2023
Package
Affected versions
< 2.0.15
>= 2.1.0, < 2.1.6
Patched versions
2.0.15
2.1.6
Description
Published by the National Vulnerability Database
May 4, 2020
Reviewed
May 25, 2021
Published to the GitHub Advisory Database
Jan 6, 2022
Last updated
Feb 1, 2023
It was found that the Apache Syncope EndUser UI login page prio to 2.0.15 and 2.1.6 reflects the successMessage parameters. By this mean, a user accessing the Enduser UI could execute javascript code from URL query string.
References