GitHub Advisoryadvisory · Maven

GHSA-v3vf-2r98-xw8w Exposure of Sensitive Information to an Unauthorized Actor in Apache syncope-cope

MEDIUM Published 2018-11-06 Modified 2024-03-04 Official page ↗
Aliases
CVE-2018-1322
Ecosystem
Maven
Packages
org.apache.syncope:syncope-core
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200
Reviewed
2020-06-16

Affected packages

• Maven org.apache.syncope:syncope-core: < 1.2.11 → fixed in 1.2.11 • Maven org.apache.syncope:syncope-core: >= 2.0.0, < 2.0.8 → fixed in 2.0.8

Description

An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11 and 2.0.x before 2.0.8 can recover sensitive security values using the fiql and orderby parameters.

Related

Alias · CVE (1)

  • CVE-2018-1322 An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References