Medium severity5.4NVD Advisory· Published Nov 6, 2018· Updated Jun 17, 2026
CVE-2018-17184
CVE-2018-17184
Description
A malicious user with enough administration entitlements can inject html-like elements containing JavaScript statements into Connector names, Report names, AnyTypeClass keys and Policy descriptions. When another user with enough administration entitlements edits one of the Entities above via Admin Console, the injected JavaScript code is executed.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.apache.syncope:syncope-coreMaven | < 2.0.11 | 2.0.11 |
org.apache.syncope:syncope-coreMaven | >= 2.1.0, < 2.1.2 | 2.1.2 |
Affected products
2- Apache Software Foundation/Apache Syncopev5Range: Apache Syncope releases prior to 2.0.11 and 2.1.2
Patches
Vulnerability mechanics
References
3- github.com/advisories/GHSA-9h9c-f287-c6vpghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2018-17184ghsaADVISORY
- syncope.apache.org/securitynvdVendor AdvisoryWEB
News mentions
0No linked articles in our index yet.