1. Home
  2. CVE Database
  3. CVE-2019-17557
MEDIUM · 5.4

CVE-2019-17557

It was found that the Apache Syncope EndUser UI login page prio to 2.0.15 and 2.1.6 reflects the successMessage parameters. By this mean, a user accessing the Enduser UI could execute javascript code ...

Vulnerability Description

It was found that the Apache Syncope EndUser UI login page prio to 2.0.15 and 2.1.6 reflects the successMessage parameters. By this mean, a user accessing the Enduser UI could execute javascript code from URL query string.

CVSS Score

5.4

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE

Affected Products

VendorProductVersions
ApacheSyncope>= 2.0.0, < 2.0.15

Related Weaknesses (CWE)

CWE-79

References

FAQ

What is CVE-2019-17557?

CVE-2019-17557 is a vulnerability with a CVSS score of 5.4 (MEDIUM). It was found that the Apache Syncope EndUser UI login page prio to 2.0.15 and 2.1.6 reflects the successMessage parameters. By this mean, a user accessing the Enduser UI could execute javascript code ...

How severe is CVE-2019-17557?

CVE-2019-17557 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2019-17557?

Check the references section above for vendor advisories and patch information. Affected products include: Apache Syncope.