CVE-2024-38379

4.8 mediumEPSS 0.7%

Medium (4.8) in apache allura. EPSS 0.7% chance of exploitation in the next 30 days.

Apache Allura's neighborhood settings are vulnerable to a stored XSS attack. Only neighborhood admins can access these settings, so the scope of risk is limited to configurations where neighborhood admins are not fully trusted. This issue affects Apache Allura: from 1.4.0 through 1.17.0. Users are recommended to upgrade to version 1.17.1, which fixes the issue.

Severity

CVSS 3.1

4.8 medium

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.7% chance of exploitation in the next 30 days; higher than 52% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2024-06-22
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

apache:allura

References

https://lists.apache.org/thread/2lb6vp00sj2b2snpmhff5lyortxjsnrp
http://www.openwall.com/lists/oss-security/2024/06/21/1
https://lists.apache.org/thread/2lb6vp00sj2b2snpmhff5lyortxjsnrp

Check your stack JSON