CVE-2018-17184

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A malicious user with enough administration entitlements can inject html-like elements containing JavaScript statements into Connector names, Report names, AnyTypeClass keys and Policy descriptions. When another user with enough administration entitlements edits one of the Entities above via Admin Console, the injected JavaScript code is executed.

Metrics

CVSS 3.0 5.4/10CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Syncope	Apache Syncope releases prior to 2.0.11 and 2.1.2

References

https://syncope.apache.org/security#CVE-2018-17184:_Stored_XSSVendor Advisory
https://syncope.apache.org/security#CVE-2018-17184:_Stored_XSSVendor Advisory

Timeline

Published: Nov 6, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-171867.2An administrator with workflow definition entitlements can use DTD to perform malicious operations, including but not limited to file read, CVE-2018-171877.4The Apache Qpid Proton-J transport includes an optional wrapper layer to perform TLS, enabled by use of the 'transport.ssl(...)' methods. Un CVE-2018-171887.2Prior to CouchDB version 2.3.0, CouchDB allowed for runtime-configuration of key components of the database. In some cases, this lead to vul CVE-2018-171895.3In Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a slow loris way to plain resources, the h2 stream for that re CVE-2018-17195.9IBM WebSphere Application Server 8.5 and 9.0 could provide weaker than expected security under certain conditions. This could result in a do CVE-2018-171909.8In all versions of Apache Spark, its standalone resource manager accepts code to execute on a 'master' host, that then runs that code on 'wo CVE-2018-171919.8Apache NetBeans (incubating) 9.0 NetBeans Proxy Auto-Configuration (PAC) interpretation is vulnerable for remote command execution (RCE). Us CVE-2018-171926.5The X-Frame-Options headers were applied inconsistently on some HTTP responses, resulting in duplicate or missing security headers. Some bro CVE-2018-171936.1The message-page.jsp error page used the value of the HTTP request header X-ProxyContextPath without sanitization, resulting in a reflected CVE-2018-171947.5When a client request to a cluster node was replicated to other nodes in the cluster for verification, the Content-Length was forwarded. On CVE-2018-171957.5The template upload API endpoint accepted requests from different domain when sent in conjunction with ARP spoofing + man in the middle (MiT CVE-2018-171968.8In Apache Kafka versions between 0.11.0.0 and 2.1.0, it is possible to manually craft a Produce request which bypasses transaction/idempoten