Loading vulnerability…
Stored XSS in Apache Syncope Console and Enduser
CVE-2024-45031 is a stored cross-site scripting (XSS) vulnerability in Apache Syncope. Incomplete HTML tags could be used to bypass HTML sanitization when editing objects in the Syncope Console, allowing attackers to inject persistent XSS payloads. These payloads would execute in the context of other users during normal application usage. Additionally, XSS payloads could be injected via the Enduser interface when editing 'Personal Information' or 'User Requests', which would then trigger for administrators in the Syncope Console.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows attackers to execute arbitrary JavaScript in the context of other users, including administrators. This can lead to session hijacking, privilege escalation, and potentially full compromise of affected user accounts.
If you can’t patch tonight, do this now.
If immediate upgrade is not possible, restrict access to the affected editing functionalities, implement additional input validation and output encoding, and monitor for suspicious activity indicative of XSS exploitation.
Patch, then assume compromise.
Upgrade Apache Syncope to version 3.0.9, which addresses the HTML sanitization bypass and prevents injection of stored XSS payloads.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.