Description
It was found that the Apache Syncope EndUser UI login page prio to 2.0.15 and 2.1.6 reflects the successMessage parameters. By this mean, a user accessing the Enduser UI could execute javascript code from URL query string.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Apache Syncope | Apache Syncope 2.0.X releases prior to 2.0.15, 2.1.X releases prior to 2.1.6 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.syncope.client:syncope-client-enduser | < 2.0.15 | 2.0.15 | GHSA-6qj8-c27w-rp33 |
| Maven | org.apache.syncope.client:syncope-client-enduser | >= 2.1.0, < 2.1.6 | 2.1.6 | GHSA-6qj8-c27w-rp33 |