VYPR
← All advisories
Medium severity4.8NVD Advisory· Published Jun 22, 2024· Updated Jun 17, 2026

CVE-2024-38379

CVE-2024-38379

Description

Apache Allura's neighborhood settings are vulnerable to a stored XSS attack.  Only neighborhood admins can access these settings, so the scope of risk is limited to configurations where neighborhood admins are not fully trusted.

This issue affects Apache Allura: from 1.4.0 through 1.17.0.

Users are recommended to upgrade to version 1.17.1, which fixes the issue.

Affected products

3
  • Apache/Allura2 versions
    cpe:2.3:a:apache:allura:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:apache:allura:*:*:*:*:*:*:*:*range: >=1.4.0,<1.17.1
    • (no CPE)range: 1.4.0 - 1.17.0
  • Apache Software Foundation/Apache Allurav5
    Range: 1.4.0

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.