CVE-2024-53679 HIGH

CVE-2024-53679: Apache VCL: XSS vulnerability in User Lookup impacting user privileges

Vendor Apache Software Foundation
Product Apache VCL
Weakness CWE-79 · XSS
Published March 25, 2025
Last update March 31, 2025
View on NVD All CVEs

CVSS base score

8.4/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/RE:M

What the vulnerability does

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache VCL in the User Lookup form. A user with sufficient rights to be able to view this part of the site can craft a URL or be tricked in to clicking a URL that will give a specified user elevated rights. This issue affects all versions of Apache VCL through 2.5.1. Users are recommended to upgrade to version 2.5.2, which fixes the issue.

Key dates

Disclosure timeline

March 25, 2025 CVE published
March 31, 2025 Record updated