CVE-2019-17557
Last modified
CVE-2019-17557 is a medium-severity vulnerability rated 5.4/10 on the CVSS scale. It was found that the Apache Syncope EndUser UI login page prio to 2.0.15 and 2.1.6 reflects the successMessage parameters. By this mean, a user accessing the Enduser UI could execute javascript code from URL query string.. EPSS estimates a 1.22% chance of exploitation in the next 30 days.
Description
It was found that the Apache Syncope EndUser UI login page prio to 2.0.15 and 2.1.6 reflects the successMessage parameters. By this mean, a user accessing the Enduser UI could execute javascript code from URL query string.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Apache | Syncope | >= 2.0.0, < 2.0.15 |
| Apache | Syncope | >= 2.1.0, < 2.1.6 |
References
- http://syncope.apache.org/securityVendor Advisory
- http://syncope.apache.org/securityVendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-17557?
How severe is CVE-2019-17557?
How do I fix CVE-2019-17557?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2019
- CVE-2019-17551In Apak Wholesale Floorplanning Finance 6.31.8.3 and 6.31.8.…6.1
- CVE-2019-17552An issue was discovered in idreamsoft iCMS v7.0.14. There is…9.8
- CVE-2019-17553An issue was discovered in MetInfo v7.0.0 beta. There is SQL…9.8
- CVE-2019-17554The XML content type entity deserializer in Apache Olingo ve…5.5
- CVE-2019-17555The AsyncResponseWrapperImpl class in Apache Olingo versions…7.5
- CVE-2019-17556Apache Olingo versions 4.0.0 to 4.6.0 provide the AbstractSe…9.8
- CVE-2019-17558Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a R…7.5
- CVE-2019-17559There is a vulnerability in Apache Traffic Server 6.0.0 to 6…9.8
- CVE-2019-1756A vulnerability in Cisco IOS XE Software could allow an auth…7.2
- CVE-2019-17560The "Apache NetBeans" autoupdate system does not validate SS…9.1
- CVE-2019-17561The "Apache NetBeans" autoupdate system does not fully valid…7.5
- CVE-2019-17562A buffer overflow vulnerability has been found in the bareme…9.8
Are you affected by CVE-2019-17557?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST