Medium severity · published Jul 22, 2024
CVE-2024-38503
When editing a user, group or any object in the Syncope Console, HTML tags could be added to any text field and could lead to potential exploits
5.4
CVSS
0.7%
EPSS
No
On KEV
Description
When editing a user, group or any object in the Syncope Console, HTML tags could be added to any text field and could lead to potential exploits.
The same vulnerability was found in the Syncope Enduser, when editing “Personal Information” or “User Requests”.
Users are recommended to upgrade to version 3.0.8, which fixes this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SY
Syncope · Apache
2.1.0 through 2.1.14; 3.0.0 before 3.0.8 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-38503
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-38503
Vendor Advisory
https://syncope.apache.org/security#cve-2024-38503-html-tags-can-be-injected-into-console-or-enduser
www.openwall.com
https://www.openwall.com/lists/oss-security/2024/07/22/3
www.openwall.com
http://www.openwall.com/lists/oss-security/2024/07/22/3
More from Syncope
9.8
CVE-2026-62183
Apache Syncope: User self-service privilege escalation
9.8
CVE-2026-57308
Apache Syncope: SQL injection vulnerability in Audit Events search
9.8
CVE-2026-53421
Apache Syncope: Remote Code Execution via Scripted Connector
9.8
CVE-2026-53405
Apache Syncope: Remote Code Execution via Flowable BPMN Groovy ScriptTask
9.8
CVE-2026-63071
Apache Syncope: RCE via Groovy Sandbox bypass