Cross-site Scripting Vulnerability in Apache VCL User Lookup Form
CVE-2024-53679

8.4HIGH

Key Information:

Vendor
Apache
Status
Apache Vcl
Vendor
CVE Published:
25 March 2025

Summary

The vulnerability allows an attacker to execute malicious scripts in the context of a user's session through improper input handling in the User Lookup form of Apache VCL. This manipulation can lead to elevated user rights if a crafted URL is accessed by a user with adequate permissions. It is critical for users to upgrade to Apache VCL version 2.5.2 to mitigate the issue and enhance web application security.

Affected Version(s)

Apache VCL 2.1 <= 2.5.1

References

https://lists.apache.org/thread/bq5vs0hndt9cz9b6rpfr5on1n...
vendor-advisory

CVSS V4

Score:
8.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Chiencp and Nothing from TeamTonTac
.