What’s Vulnerable › Vulnerabilities

CVE-2024-38379: Apache Allura: Stored authenticated XSS

• Severity: medium (CVSS 4.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-06-22 · updated 2026-06-17
• Weakness: CWE-79

Description

Apache Allura's neighborhood settings are vulnerable to a stored XSS attack.  Only neighborhood admins can access these settings, so the scope of risk is limited to configurations where neighborhood admins are not fully trusted. This issue affects Apache Allura: from 1.4.0 through 1.17.0. Users are recommended to upgrade to version 1.17.1, which fixes the issue.

Affected products

• Apache Software Foundation Apache Allura: from 1.4.0 before 1.17.1 — fixed in 1.17.1

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache Allura 1.17.1. Check the vendor advisory for mitigations.

References

• https://lists.apache.org/thread/2lb6vp00sj2b2snpmhff5lyortxjsnrp
• http://www.openwall.com/lists/oss-security/2024/06/21/1
• https://lists.apache.org/thread/2lb6vp00sj2b2snpmhff5lyortxjsnrp

Get alerted when CVE-2024-38379 or the next vulnerability affects your stack