CVE-2024-53679

25.03.2025, 10:15

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache VCL in the User Lookup form. A user with sufficient rights to be able to view this part of the site can craft a URL or be tricked in to clicking a URL that will give a specified user elevated rights.

This issue affects all versions of Apache VCL through 2.5.1.

Users are recommended to upgrade to version 2.5.2, which fixes the issue.

Cross-site Scripting

Provider	Type	Base Score	Vector
NIST	NIST	UNKNOWN	---
apache	CNA	---	---
CVE	ADP	---	---
CISA-ADP	ADP	---	---

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: 17%

Common Weakness Enumeration

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References

https://lists.apache.org/thread/bq5vs0hndt9cz9b6rpfr5on1nd4qrmyr

http://www.openwall.com/lists/oss-security/2025/03/24/2