GitHub Advisoryadvisory · Maven
GHSA-xgc9-9w4v-h33h High severity vulnerability that affects org.apache.syncope:syncope-core
HIGH
Official page ↗
- Aliases
- CVE-2018-1321
- Ecosystem
- Maven
- Packages
- org.apache.syncope:syncope-core
- Severity
- High
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-20
- Reviewed
- 2020-06-16
Affected packages
• Maven org.apache.syncope:syncope-core: < 1.2.11 → fixed in 1.2.11
• Maven org.apache.syncope:syncope-core: >= 2.0.0, < 2.0.8 → fixed in 2.0.8
Description
An administrator with report and template entitlements in Apache Syncope 1.2.x before 1.2.11 and 2.0.x before 2.0.8 can use XSL Transformations (XSLT) to perform malicious operations, including but not limited to file read, file write, and code execution.
Related
Alias · CVE (1)
- CVE-2018-1321 An administrator with report and template entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases… vulnerability
Weakness · CWE (1)
- CWE-20 Improper Input Validation weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2018-1321 advisory
- https://github.com/apache/syncope/commit/726231fbf7b817bd2a9467171dcb1c0087c75bc web
- https://github.com/apache/syncope/commit/ad31479c1c543ac7d26b8c882aa14f6c00c1fd0 web
- https://github.com/advisories/GHSA-xgc9-9w4v-h33h advisory
- https://www.exploit-db.com/exploits/45400 web
- http://syncope.apache.org/security.html#CVE-2018-1321:_Remote_code_execution_by_administrators_with_report_and_template_entitlements web
- http://www.securityfocus.com/bid/103508 web