CVE-2019-17557: XSS
Published May 4, 2020
·Updated
It was found that the Apache Syncope EndUser UI login page prio to 2.0.15 and 2.1.6 reflects the successMessage parameters. By this mean, a user accessing the Enduser UI could execute javascript code from URL query string.
Affected Software
2 affected components
Apache Syncope>=2.0.0<2.0.15
Apache Syncope>=2.1.0<2.1.6
Event History
May 4, 2020
CVE Published
via MITRE·12:27 PM
Data Sourced
via MITRE·12:27 PM
DescriptionWeakness
Frequently Asked Questions
1
What is CVE-2019-17557?
CVE-2019-17557 is a vulnerability found in the Apache Syncope EndUser UI login page prior to version 2.0.15 and 2.1.6.
2
What is the severity of CVE-2019-17557?
The severity of CVE-2019-17557 is medium with a severity value of 5.4.
3
How does CVE-2019-17557 affect Apache Syncope?
CVE-2019-17557 affects Apache Syncope versions between 2.0.0 and 2.0.15, as well as versions between 2.1.0 and 2.1.6.
4
What is the CWE for CVE-2019-17557?
The CWE (Common Weakness Enumeration) for CVE-2019-17557 is CWE-79, which is a code injection vulnerability.
5
How can I mitigate CVE-2019-17557?
To mitigate CVE-2019-17557, it is recommended to update Apache Syncope to a version higher than 2.0.15 or 2.1.6.