VulnerabilityModified

CVE-2024-38379

Apache Allura's neighborhood settings are vulnerable to a stored XSS attack.

MEDIUM 4.8EPSS 0.69%

Does this matter?

Lower severity and a low EPSS score (0.69%). Track it; it rarely justifies an emergency change on its own.

Description

Apache Allura's neighborhood settings are vulnerable to a stored XSS attack. Only neighborhood admins can access these settings, so the scope of risk is limited to configurations where neighborhood admins are not fully trusted. This issue affects Apache Allura: from 1.4.0 through 1.17.0. Users are recommended to upgrade to version 1.17.1, which fixes the issue.

CVSS 3.1: 4.8 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
EPSS: 0.69% probability · 51th percentile
CISA KEV: Not listed
Weakness: CWE-79
Affected: apache/allura
Source: security@apache.org

References

https://lists.apache.org/thread/2lb6vp00sj2b2snpmhff5lyortxjsnrpVendor Advisory
http://www.openwall.com/lists/oss-security/2024/06/21/1
https://lists.apache.org/thread/2lb6vp00sj2b2snpmhff5lyortxjsnrpVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.