CVE-2018-17184

5.4 mediumEPSS 1.2%

Medium (5.4) in apache syncope. EPSS 1.2% chance of exploitation in the next 30 days. Fixed in org.apache.syncope:syncope-core 2.0.11, 2.1.2.

A malicious user with enough administration entitlements can inject html-like elements containing JavaScript statements into Connector names, Report names, AnyTypeClass keys and Policy descriptions. When another user with enough administration entitlements edits one of the Entities above via Admin Console, the injected JavaScript code is executed.

Severity

CVSS 3.0

5.4 medium

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS: 1.2% chance of exploitation in the next 30 days; higher than 68% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2018-11-06
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

apache:syncope

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-9h9c-f287-c6vp	Maven	org.apache.syncope:syncope-core	<2.0.11	2.0.11
GHSA-9h9c-f287-c6vp	Maven	org.apache.syncope:syncope-core	>=2.1.0 <2.1.2	2.1.2

References

Check your stack JSON