Medium severity · published Jun 22, 2024
CVE-2024-38379
Apache Allura's neighborhood settings are vulnerable to a stored XSS attack. Only neighborhood admins can access these settings, so the scope of risk is limited to configurations…
4.8
CVSS
0.7%
EPSS
No
On KEV
Description
Apache Allura's neighborhood settings are vulnerable to a stored XSS attack. Only neighborhood admins can access these settings, so the scope of risk is limited to configurations where neighborhood admins are not fully trusted.
This issue affects Apache Allura: from 1.4.0 through 1.17.0.
Users are recommended to upgrade to version 1.17.1, which fixes the issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AL
Allura · Apache
1.4.0 before 1.17.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-38379
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-38379
Vendor Advisory
https://lists.apache.org/thread/2lb6vp00sj2b2snpmhff5lyortxjsnrp
www.openwall.com
http://www.openwall.com/lists/oss-security/2024/06/21/1
More from Allura
9.8
CVE-2026-73240
Apache Allura: Git command injection
9.1
CVE-2026-69223
Apache Allura: Server-side request forgery
7.5
CVE-2024-36471
Import functionality is vulnerable to DNS rebinding attacks between verification and processing of the URL. Project administrators can run these imports, which could cause Allura…
7.5
CVE-2018-1299
In Apache Allura before 1.8.0, unauthenticated attackers may retrieve arbitrary files through the Allura web application
6.5
CVE-2026-73239
Apache Allura: Missing permission checks IDOR