It was found that the Apache Syncope EndUser UI login page prio to 2.0.15 and 2.1.6 reflects the successMessage parameters. By this mean, a user accessing the Enduser UI could execute javascript code from URL query string.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| org.apache.syncope.client:syncope-client-enduser(Maven) | 0 | 2.0.15 | N/A |
| org.apache.syncope.client:syncope-client-enduser(Maven) | 2.1.0 | 2.1.6 | N/A |
CVSS Metrics
