Vulnerability Database

299,038

Total vulnerabilities in the database

CVE-2019-17557

It was found that the Apache Syncope EndUser UI login page prio to 2.0.15 and 2.1.6 reflects the successMessage parameters. By this mean, a user accessing the Enduser UI could execute javascript code from URL query string.

Published: May 4, 2020
Updated: May 9, 2024
CVE: CVE-2019-17557
GHSA: GHSA-6qj8-c27w-rp33
Severity: Medium
Exploit:

CVSS v3:

Severity: Medium
Score: 5.4
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CVSS v2:

Severity: Low
Score: 3.5
AV:N/AC:M/Au:S/C:N/I:P/A:N

CWEs:

CWE-79

OWASP TOP 10:

A7 - Cross-Site Scripting (XSS)

Affected Software
References

Software	From	Fixed in
apache / syncope	2.1.0	2.1.6
apache / syncope	2.0.0	2.0.15
org.apache.syncope.client / syncope-client-enduser	-	2.0.15
org.apache.syncope.client / syncope-client-enduser	2.1.0	2.1.6

http://syncope.apache.org/security

Deep Security Visibility Without the Complexity

SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.

No setup fees
5-min deployment
Cancel anytime

Book a Demo