CVE-2024-38379

published 2024-06-22

CVE-2024-38379: Apache Allura's neighborhood settings are vulnerable to a stored XSS attack. Only neighborhood admins can access these settings, so the scope of risk is…

Priority P4 22 medium 4.8 CVSS 3.1

AV N AC L PR H UI R S C C L I L A N

Apache Allura's neighborhood settings are vulnerable to a stored XSS attack. Only neighborhood admins can access these settings, so the scope of risk is limited to configurations where neighborhood admins are not fully trusted.

This issue affects Apache Allura: from 1.4.0 through 1.17.0.

Users are recommended to upgrade to version 1.17.1, which fixes the issue.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
apache	allura	>= 1.4.0 < 1.17.1	1.17.1
apache_software_foundation	apache_allura	1.4.0 – 1.17.0	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-79