Allura's Neighborhood Settings Vulnerable to Stored XSS Attack
CVE-2024-38379

4.8MEDIUM

Key Information:

Vendor
Apache
Status
Apache Allura
Vendor
CVE Published:
22 June 2024

Summary

Apache Allura's neighborhood settings are vulnerable to a stored XSS attack.  Only neighborhood admins can access these settings, so the scope of risk is limited to configurations where neighborhood admins are not fully trusted.

This issue affects Apache Allura: from 1.4.0 through 1.17.0.

Users are recommended to upgrade to version 1.17.1, which fixes the issue.

Affected Version(s)

Apache Allura 1.4.0 <= 1.17.0

References

https://lists.apache.org/thread/2lb6vp00sj2b2snpmhff5lyor...
vendor-advisory

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ömer "WASP" Akincir
.