CVE-2024-38503
Apache Syncope: HTML tags can be injected into Console or Enduser text fields
When editing a user, group or any object in the Syncope Console, HTML tags could be added to any text field and could lead to potential exploits. The same vulnerability was found in the Syncope Enduser, when editing “Personal Information” or “User Requests”.
Users are recommended to upgrade to version 3.0.8, which fixes this issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
When editing a user, group or any object in the Syncope Console, HTML tags could be added to any text field and could lead to potential exploits. The same vulnerability was found in the Syncope Enduser, when editing “Personal Information” or “User Requests”.
Users are recommended to upgrade to version 3.0.8, which fixes this issue.
- Record
CVE-2024-38503- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - CVSS 3.1
- 3.9 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List
Apache Syncope: HTML tags can be injected into Console or Enduser text fields
When editing a user, group or any object in the Syncope Console, HTML tags could be added to any text field and could lead to potential exploits. The same vulnerability was found in the Syncope Enduser, when editing “Personal Information” or “User Requests”.
Users are recommended to upgrade to version 3.0.8, which fixes this issue.
- Record
CVE-2024-38503- CVSS 3.1
- 3.9 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2024-2304
When editing a user, group or any object in the Syncope Console, HTML tags could be added to any text field and could lead to potential exploits. The same vulnerability was found in the Syncope Enduser, when editing “Personal Information” or “User Requests”.
Users are recommended to upgrade to version 3.0.8, which fixes this issue.
- Record
EUVD-2024-2304- CVSS 3.1
- 3.9 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8pxv-x6jq-5vw9
Apache Syncope Improper Input Validation vulnerability
When editing a user, group or any object in the Syncope Console, HTML tags could be added to any text field and could lead to potential exploits. The same vulnerability was found in the Syncope Enduser, when editing "Personal Information" or "User Requests".
Users are recommended to upgrade to version 3.0.8, which fixes this issue.
- Record
GHSA-8pxv-x6jq-5vw9- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-20, CWE-79
- Updated
- 2026-11-02
OSV
Apache Syncope: HTML tags can be injected into Console or Enduser text fields
When editing a user, group or any object in the Syncope Console, HTML tags could be added to any text field and could lead to potential exploits. The same vulnerability was found in the Syncope Enduser, when editing “Personal Information” or “User Requests”.
Users are recommended to upgrade to version 3.0.8, which fixes this issue.
- Record
CVE-2024-38503- CVSS 3.1
- 3.9 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-8pxv-x6jq-5vw9
Apache Syncope Improper Input Validation vulnerability
When editing a user, group or any object in the Syncope Console, HTML tags could be added to any text field and could lead to potential exploits. The same vulnerability was found in the Syncope Enduser, when editing "Personal Information" or "User Requests".
Users are recommended to upgrade to version 3.0.8, which fixes this issue.
- Record
GHSA-8pxv-x6jq-5vw9- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-20, CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.syncope.client.idrepo:syncope-client-idrepo-common-uiMaven |
2.1.0 up to 3.0.8 | 3.0.8 |
org.apache.syncope.client.idrepo:syncope-client-idrepo-consoleMaven |
2.1.0 up to 3.0.8 | 3.0.8 |
org.apache.syncope.client.idrepo:syncope-client-idrepo-common-uiMaven |
2.1.0 up to 3.0.8, plus listed versions 3.0.03.0.0-M03.0.0-M13.0.0-M23.0.1 Show 6 moreShow less3.0.23.0.33.0.43.0.53.0.63.0.7 |
3.0.8 |
org.apache.syncope.client.idrepo:syncope-client-idrepo-consoleMaven |
2.1.0 up to 3.0.8, plus listed versions 3.0.03.0.0-M03.0.0-M13.0.0-M23.0.1 Show 6 moreShow less3.0.23.0.33.0.43.0.53.0.63.0.7 |
3.0.8 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-38503 is a medium vulnerability (CVSS 5.4) in Apache Syncope, published July 22, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.71%, the 53rd percentile. Fixed in org.apache.syncope.client.idrepo:syncope-client-idrepo-common-ui 3.0.8.
References
syncope.apache.org/security
openwall.com/lists/oss-security/2024/07/22/3
nvd.nist.gov/vuln/detail/CVE-2024-38503
github.com/apache/syncope/commit/12e65f5fb12ad87ce0b223b3c2bb39025a4521e4