CVE-2018-17184

Description

A malicious user with enough administration entitlements can inject html-like elements containing JavaScript statements into Connector names, Report names, AnyTypeClass keys and Policy descriptions. When another user with enough administration entitlements edits one of the Entities above via Admin Console, the injected JavaScript code is executed.

Risk Information

Base Score

5.4

MODERATE

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS Score

Exploitation Probability

1.003

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2018-17184,CVE-2018-17186 are fixed in Apache-syncope-core 2.0.11	Windows
Vulnerabilities CVE-2018-17184,CVE-2018-17186 are fixed in Apache-syncope-core 2.1.2	Windows
Vulnerabilities CVE-2018-17184,CVE-2018-17186 are fixed in Apache-syncope-core for Linux 2.0.11	Linux
Vulnerabilities CVE-2018-17184,CVE-2018-17186 are fixed in Apache-syncope-core for Linux 2.1.2	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234