CVE-2019-17557: 
Java vulnerability analysis and mitigation

Apache Syncope EndUser UI login page prior to versions 2.0.15 and 2.1.6 was found to contain a Cross-Site Scripting (XSS) vulnerability identified as CVE-2019-17557. The vulnerability allowed users to execute JavaScript code through URL query string parameters by exploiting the reflection of successMessage parameters (Vendor Advisory).

The vulnerability is classified as a Cross-Site Scripting (XSS) issue with a CVSS v3.1 Base Score of 5.4 (Medium) and vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The vulnerability is tracked as CWE-79 (Improper Neutralization of Input During Web Page Generation) and affects Apache Syncope versions from 2.0.0 to 2.0.15 and 2.1.0 to 2.1.6 (NVD).

The vulnerability allows attackers to execute arbitrary JavaScript code when users access the Enduser UI through manipulated URL query strings. This could potentially lead to session hijacking or other client-side attacks (Vendor Advisory).

The vulnerability requires low attack complexity and can be exploited by an attacker with low privileges. However, user interaction is required as the victim must access a specifically crafted URL for the exploit to work (NVD).

Users are recommended to upgrade to Apache Syncope version 2.0.15 for the 2.0.X series or version 2.1.6 for the 2.1.X series, which contain fixes for this vulnerability (Vendor Advisory).