CVE-2018-17184
Quick assessment
Affected
Apache Software Foundation Apache Syncope
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache Syncope是美国阿帕奇（Apache）软件基金会的一套用于企业环境中的开源数字身份管理系统。该系统支持身份管理、角色配置等。 Apache Syncope 2.0.11之前的版本和2.1.2之前的版本中存在跨站脚本漏洞。远程攻击者可利用该漏洞执行任意JavaScript代码。
Possible ATT&CK Techniques 3 AI
T1059.006 · Python T1059.008 · Network Device CLI T1059.007 · JavaScript
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2018-17184
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
A malicious user with enough administration entitlements can inject html-like elements containing JavaScript statements into Connector names, Report names, AnyTypeClass keys and Policy descriptions. When another user with enough administration entitlements edits one of the Entities above via Admin Console, the injected JavaScript code is executed.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Apache Syncope 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache Syncope是美国阿帕奇（Apache）软件基金会的一套用于企业环境中的开源数字身份管理系统。该系统支持身份管理、角色配置等。 Apache Syncope 2.0.11之前的版本和2.1.2之前的版本中存在跨站脚本漏洞。远程攻击者可利用该漏洞执行任意JavaScript代码。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Syncope | Apache Syncope releases prior to 2.0.11 and 2.1.2 | - |
|
II. Public POCs for CVE-2018-17184
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2018-17184
请登录查看更多情报信息。
Vendor Advisories for CVE-2018-17184 (1)
IV. Related Vulnerabilities
Same product: Apache Syncope
-
CVE-2026-73191
Apache Syncope: CAS service URL injection via Forwarded HTTP -
CVE-2026-73195
Apache Syncope: CSV export spreadsheet formula injection -
CVE-2026-73236
Apache Syncope: Cross-Realm authorization bypass in delegate -
CVE-2026-73370
Apache Syncope: Cross-Realm boundaries reconciliation bypass -
CVE-2026-73178
Apache Syncope: JWT Access Token takeover
Same vendor: Apache Software Foundation
-
CVE-2026-70410
Apache Calcite Avatica: Unrestricted class initialization wh -
CVE-2026-94301
Apache MINA: CVE-2026-47065 resolveProxyClass fix missing fr -
CVE-2026-86473
Apache Airflow: Logout ignores a presented Authorization bea -
CVE-2026-75158
Apache Airflow: Assets events API returns asset events for e -
CVE-2026-82355
Apache Airflow: Session cookie silently overrides explicit A
V. Comments for CVE-2018-17184
No comments yet