CVE-2018-17184

5.4MEDIUM

Key Information:

Vendor
Apache
Status
Apache Syncope
Vendor
CVE Published:
6 November 2018

Summary

A malicious user with enough administration entitlements can inject html-like elements containing JavaScript statements into Connector names, Report names, AnyTypeClass keys and Policy descriptions. When another user with enough administration entitlements edits one of the Entities above via Admin Console, the injected JavaScript code is executed.

Affected Version(s)

Apache Syncope Apache Syncope releases prior to 2.0.11 and 2.1.2

References

https://syncope.apache.org/security#CVE-2018-17184:_Store...
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.