Description (CNA)
It was found that the Apache Syncope EndUser UI login page prio to 2.0.15 and 2.1.6 reflects the successMessage parameters. By this mean, a user accessing the Enduser UI could execute javascript code from URL query string.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| n/a / Apache Syncope | affected Apache Syncope 2.0.X releases prior to 2.0.15, 2.1.X releases prior to 2.1.6 |
CWE
No CWE identifiers supplied.
References
ADP enrichment
No English description supplied.