GitHub Advisoryadvisory · Maven

GHSA-r2xf-w5pj-9pw8 Apache Syncope JEXL Code Injection

MEDIUM Published 2022-05-14 Modified 2023-08-16 Official page ↗
Aliases
CVE-2014-0111
Ecosystem
Maven
Packages
org.apache.syncope:syncope
Severity
Moderate
Weaknesses
CWE-94
Reviewed
2023-08-16

Affected packages

• Maven org.apache.syncope:syncope: >= 1.0.0, < 1.0.9 → fixed in 1.0.9 • Maven org.apache.syncope:syncope: >= 1.1.0, < 1.1.7 → fixed in 1.1.7

Description

Apache Syncope 1.0.0 before 1.0.9 and 1.1.0 before 1.1.7 allows remote administrators to execute arbitrary Java code via vectors related to Apache Commons JEXL expressions, "derived schema definition," "user / role templates," and "account links of resource mappings."

Related

Alias · CVE (1)

  • CVE-2014-0111 Apache Syncope 1.0.0 before 1.0.9 and 1.1.0 before 1.1.7 allows remote administrators to execute arbitrary Java code via vectors related to… vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References