CVE-2024-38379: Apache Allura: Stored authenticated XSS
Apache Allura's neighborhood settings are vulnerable to a stored XSS attack. Only neighborhood admins can access these settings, so the scope of risk is limited to configurations where neighborhood admins are not fully trusted.
This issue affects Apache Allura: from 1.4.0 through 1.17.0.
Users are recommended to upgrade to version 1.17.1, which fixes the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-38379?
CVE-2024-38379 is considered a medium severity vulnerability due to the potential for stored XSS attacks.
How do I fix CVE-2024-38379?
To fix CVE-2024-38379, upgrade Apache Allura to version 1.17.2 or later.
Who is affected by CVE-2024-38379?
CVE-2024-38379 affects installations of Apache Allura from version 1.4.0 through 1.17.1 where neighborhood admins are not fully trusted.
What kind of attack is associated with CVE-2024-38379?
CVE-2024-38379 is associated with a stored Cross-Site Scripting (XSS) attack.
Is CVE-2024-38379 a remote or local vulnerability?
CVE-2024-38379 is a local vulnerability as it requires admin access to neighborhood settings to exploit.