CVE-2024-53679 | THREATINT

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache VCL in the User Lookup form. A user with sufficient rights to be able to view this part of the site can craft a URL or be tricked in to clicking a URL that will give a specified user elevated rights. This issue affects all versions of Apache VCL through 2.5.1. Users are recommended to upgrade to version 2.5.2, which fixes the issue.

Reserved 2024-11-21 | Published 2025-03-25 | Updated 2025-03-31 | Assigner apache

HIGH: 8.4CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/RE:M

Problem types

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Product status

Default status

unaffected

2.1

affected

Credits

Chiencp and Nothing from TeamTonTac finder

References

lists.apache.org/thread/bq5vs0hndt9cz9b6rpfr5on1nd4qrmyr vendor-advisory

cve.org (CVE-2024-53679)

nvd.nist.gov (CVE-2024-53679)

Download JSON