CVE-2019-17557

5.4MEDIUM

Key Information:

Vendor
Apache
Status
Apache Syncope
Vendor
CVE Published:
4 May 2020

Summary

It was found that the Apache Syncope EndUser UI login page prio to 2.0.15 and 2.1.6 reflects the successMessage parameters. By this mean, a user accessing the Enduser UI could execute javascript code from URL query string.

Affected Version(s)

Apache Syncope Apache Syncope 2.0.X releases prior to 2.0.15, 2.1.X releases prior to 2.1.6

References

http://syncope.apache.org/security
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.