Tracker / CVE-2024-38503
CVE-2024-38503
Medium 5.4
When editing a user, group or any object in the Syncope Console, HTML tags could be added to any text field and could lead to potential exploits. The same vulnerability was found in the Syncope Enduser, when editing “Personal Information” or “User Requests”. Users are recommended to upgrade to version 3.0.8, which fixes this issue.
Affected products and versions
| apache | syncope · 2.1.0 → 2.1.14 |
|---|---|
| apache | syncope · 3.0.0 → 3.0.8 |
Analysis
This page is not indexable yet.Until it carries original analysis — what it actually exposes, how to check in two minutes whether a system was touched, what to do if it was — the page stays noindex. The database decides that, not the template.