| Package | Affected versions | Patched versions |
|---|---|---|
| org.apache.syncope.client:syncope-client-enduser | ≥ 2.1.0, < 2.1.6< 2.0.15 | 2.1.62.0.15 |
| syncope | ≥ 2.0.0, < 2.0.15≥ 2.1.0, < 2.1.6 | 2.0.152.1.6 |
It was found that the Apache Syncope EndUser UI login page prio to 2.0.15 and 2.1.6 reflects the successMessage parameters. By this mean, a user accessing the Enduser UI could execute javascript code from URL query string.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free