Products
Apache Allura
- 1.4.0
- 1.17.0
Source
security@apache.org
Tags
CVE-2024-38379 details
Published : June 22, 2024, 9:15 a.m.
Last Modified : June 22, 2024, 9:15 a.m.
Last Modified : June 22, 2024, 9:15 a.m.
Description
Apache Allura's neighborhood settings are vulnerable to a stored XSS attack. Only neighborhood admins can access these settings, so the scope of risk is limited to configurations where neighborhood admins are not fully trusted. This issue affects Apache Allura: from 1.4.0 through 1.17.0. Users are recommended to upgrade to version 1.17.1, which fixes the issue.
CVSS Score
| 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 |
|---|
Weakness
| Weakness | Name | Description |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
References
| URL | Source |
|---|---|
| https://lists.apache.org/thread/2lb6vp00sj2b2snpmhff5lyortxjsnrp | security@apache.org |
This website uses the NVD API, but is not approved or certified by it.