What is GHSA-9h9c-f287-c6vp?

GHSA-9h9c-f287-c6vp is a security advisory published by GitHub Security Advisories with Medium severity. Improper Control of Interaction Frequency in Apache syncope-core

Which CVE IDs does GHSA-9h9c-f287-c6vp cover?

GHSA-9h9c-f287-c6vp covers the following CVE IDs: CVE-2018-17184. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-9h9c-f287-c6vp?

GHSA-9h9c-f287-c6vp has a CVSS v3 base score of 5.4, published by GitHub Security Advisories.

Which products are affected by GHSA-9h9c-f287-c6vp?

GHSA-9h9c-f287-c6vp affects 2 products, including: maven/org.apache.syncope:syncope-core:\u003c 2.0.11; maven/org.apache.syncope:syncope-core:\u003e= 2.1.0, \u003c 2.1.2.

GHSA-9h9c-f287-c6vpMediumCVSS 5.4

Improper Control of Interaction Frequency in Apache syncope-core

Vendor

GitHub Security Advisories

Published

November 6, 2018

Last Modified

January 9, 2023

🔗 CVE IDs covered (1)

CVE-2018-17184 →

📋 Description

A malicious user with enough administration entitlements can inject html-like elements containing JavaScript statements into Connector names, Report names, AnyTypeClass keys and Policy descriptions. When another user with enough administration entitlements edits one of the Entities above via Admin Console, the injected JavaScript code is executed.

🎯 Affected products2

maven/org.apache.syncope:syncope-core:< 2.0.11
maven/org.apache.syncope:syncope-core:>= 2.1.0, < 2.1.2

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2018-17184
https://github.com/advisories/GHSA-9h9c-f287-c6vp
https://syncope.apache.org/security#CVE-2018-17184:_Stored_XSS