CVE-2019-17557

It was found that the Apache Syncope EndUser UI login page prio to 2.0.15 and 2.1.6 reflects the successMessage parameters. By this mean, a user accessing the Enduser UI could execute javascript code from URL query string.

Score

CVSS 3.1 5.4 Medium

Status

Modified - security@apache.org

Published

2020-05-04

Last modified

2024-08-05

Weaknesses

CWE-79

Affected products

• Syncope (Apache)

References

• http://syncope.apache.org/security