What is the severity of CVE-2024-53679?

CVE-2024-53679 is classified as a high severity vulnerability due to its potential for exploitation via cross-site scripting.

How do I fix CVE-2024-53679?

To fix CVE-2024-53679, it is recommended to upgrade to Apache VCL version 2.5.2 or later.

Who is affected by CVE-2024-53679?

Users with sufficient rights to access the User Lookup form in Apache VCL version up to 2.5.1 are affected by CVE-2024-53679.

What type of vulnerability is CVE-2024-53679?

CVE-2024-53679 is an improper neutralization of input during web page generation, specifically a cross-site scripting vulnerability.

Can CVE-2024-53679 be exploited through a crafted URL?

Yes, CVE-2024-53679 can be exploited if a user clicks on a crafted URL that triggers the cross-site scripting vulnerability.

Vulnerability/
CVE-2024-53679

high

8.4

CWE

24/3/2025

25/3/2025

31/3/2025

CVE-2024-53679: Apache VCL: XSS vulnerability in User Lookup impacting user privileges

First published: Mon Mar 24 2025(Updated: )

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache VCL in the User Lookup form. A user with sufficient rights to be able to view this part of the site can craft a URL or be tricked in to clicking a URL that will give a specified user elevated rights. This issue affects all versions of Apache VCL through 2.5.1. Users are recommended to upgrade to version 2.5.2, which fixes the issue.

Credit: security@apache.org

Affected Software	Affected Version	How to fix
Apache Virtual Computing Lab	<=2.5.1

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is the severity of CVE-2024-53679?
CVE-2024-53679 is classified as a high severity vulnerability due to its potential for exploitation via cross-site scripting.
How do I fix CVE-2024-53679?
To fix CVE-2024-53679, it is recommended to upgrade to Apache VCL version 2.5.2 or later.
Who is affected by CVE-2024-53679?
Users with sufficient rights to access the User Lookup form in Apache VCL version up to 2.5.1 are affected by CVE-2024-53679.
What type of vulnerability is CVE-2024-53679?
CVE-2024-53679 is an improper neutralization of input during web page generation, specifically a cross-site scripting vulnerability.
Can CVE-2024-53679 be exploited through a crafted URL?
Yes, CVE-2024-53679 can be exploited if a user clicks on a crafted URL that triggers the cross-site scripting vulnerability.

collector/oss-sec
source/oss-sec
alias/CVE-2024-53679
agent/title
agent/first-publish-date
collector/mitre-cve
source/MITRE
collector/nvd-api
source/NVD
agent/severity
agent/last-modified-date
agent/source
agent/references
agent/type
agent/description
agent/weakness
agent/author
agent/trending
agent/event
agent/softwarecombine
agent/tags
agent/guess-ai
agent/software-canonical-lookup
vendor/apache
canonical/apache virtual computing lab

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.