{"action":"Upgrade org.apache.syncope.client.idrepo:syncope-client-idrepo-common-ui to 3.0.8 or later.","affected":[{"fixed":"3.0.8","introduced":"2.1.0"}],"component":"org.apache.syncope.client.idrepo:syncope-client-idrepo-common-ui","cve_ids":["CVE-2024-38503"],"ecosystem":"Maven","epss":0.00708,"exploited":false,"fixed_versions":["3.0.8"],"ghsa_id":"GHSA-8pxv-x6jq-5vw9","id":"tcs_01M5N8N6D08W1JDP6WW5MDEFKB","modified_at":"2024-12-07T00:37:45.481925Z","published_at":"2024-07-22T12:30:37Z","references":["https://osv.dev/vulnerability/GHSA-8pxv-x6jq-5vw9","https://nvd.nist.gov/vuln/detail/CVE-2024-38503","https://github.com/apache/syncope/commit/12e65f5fb12ad87ce0b223b3c2bb39025a4521e4","https://github.com/apache/syncope","https://github.com/apache/syncope/releases/tag/syncope-3.0.8","https://syncope.apache.org/security#cve-2024-38503-html-tags-can-be-injected-into-console-or-enduser","https://www.openwall.com/lists/oss-security/2024/07/22/3"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-8pxv-x6jq-5vw9","url":"https://osv.dev/vulnerability/GHSA-8pxv-x6jq-5vw9"}],"summary":"Apache Syncope Improper Input Validation vulnerability"}