Medium severity · published Oct 24, 2024
CVE-2024-45031
When editing objects in the Syncope Console, incomplete HTML tags could be used to bypass HTML sanitization
6.1
CVSS
0.7%
EPSS
No
On KEV
Description
When editing objects in the Syncope Console, incomplete HTML tags could be used to bypass HTML sanitization. This made it possible to inject stored XSS payloads which would trigger for other users during ordinary usage of the application.
XSS payloads could also be injected in Syncope Enduser when editing “Personal Information” or “User Requests”: such payloads would trigger for administrators in Syncope Console, thus enabling session hijacking.
Users are recommended to upgrade to version 3.0.9, which fixes this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SY
Syncope · Apache
2.1.0 before 3.0.9 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-45031
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-45031
Mailing List
https://lists.apache.org/thread/fn567pfmo3s55ofkc42drz8b4kgbhp9m
Mailing List
http://www.openwall.com/lists/oss-security/2024/10/24/2
More from Syncope
9.8
CVE-2026-62183
Apache Syncope: User self-service privilege escalation
9.8
CVE-2026-57308
Apache Syncope: SQL injection vulnerability in Audit Events search
9.8
CVE-2026-53421
Apache Syncope: Remote Code Execution via Scripted Connector
9.8
CVE-2026-53405
Apache Syncope: Remote Code Execution via Flowable BPMN Groovy ScriptTask
9.8
CVE-2026-63071
Apache Syncope: RCE via Groovy Sandbox bypass