GHSA-6qj8-c27w-rp33
Cross-site scripting in Apache Syncome EndUser
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.apache.syncope.client:syncope-client-enduser | < 2.0.15 | 2.0.15 |
| Maven | org.apache.syncope.client:syncope-client-enduser | >= 2.1.0, < 2.1.6 | 2.1.6 |
Details
As written in the advisory (Markdown source, shown as plain text).
It was found that the Apache Syncope EndUser UI login page prio to 2.0.15 and 2.1.6 reflects the successMessage parameters. By this mean, a user accessing the Enduser UI could execute javascript code from URL query string.
References
External links from the advisory. They lead to third-party sites.