What’s Vulnerable › Vulnerabilities

CVE-2024-38503: Apache Syncope: HTML tags can be injected into Console or Enduser text fields

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-07-22 · updated 2026-06-17
• Weakness: CWE-79

Description

When editing a user, group or any object in the Syncope Console, HTML tags could be added to any text field and could lead to potential exploits. The same vulnerability was found in the Syncope Enduser, when editing “Personal Information” or “User Requests”. Users are recommended to upgrade to version 3.0.8, which fixes this issue.

Affected products

• Apache Software Foundation Apache Syncope: from 2.1.0 through 2.1.14; from 3.0.0 before 3.0.8 — fixed in 3.0.8

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache Syncope 3.0.8. Check the vendor advisory for mitigations.

References

• https://syncope.apache.org/security#cve-2024-38503-html-tags-can-be-injected-into-console-or-enduser
• https://www.openwall.com/lists/oss-security/2024/07/22/3
• http://www.openwall.com/lists/oss-security/2024/07/22/3
• https://syncope.apache.org/security#cve-2024-38503-html-tags-can-be-injected-into-console-or-enduser

Get alerted when CVE-2024-38503 or the next vulnerability affects your stack