CVE-2024-53679

MEDIUM 5.4CVE-2024-53679 · Published 25/03/2025 · updated 17/06/2026

In short

CVE-2024-53679 is a MEDIUM (CVSS 5.4) vulnerability affecting vcl (apache).
Chance of exploitation in the next 30 days (EPSS): 0.54%, higher than 45.4% of all vulnerabilities.
Fix: update to 2.5.2 or later.

Package	Affected versions	Patched versions
vcl apache	`≥ 2.1, < 2.5.2`	`2.5.2`

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache VCL in the User Lookup form. A user with sufficient rights to be able to view this part of the site can craft a URL or be tricked in to clicking a URL that will give a specified user elevated rights. This issue affects all versions of Apache VCL through 2.5.1. Users are recommended to upgrade to version 2.5.2, which fixes the issue.

References

lists.apache.org/thread/bq5vs0hndt9cz9b6rpfr5on1nd4qrmyr · Issue Tracking
openwall.com/lists/oss-security/2025/03/24/2 · Mailing List

More vulnerabilities in vcl

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free