CVSS 3.0
7.2 highCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HCVE-2018-1321
An administrator with report and template entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can use XSL Transformations (XSLT) to perform malicious operations, including but not limited to file read, file write, and code execution.
Severity
- EPSS
- 18% chance of exploitation in the next 30 days; higher than 97% of CVEs (scores of 2026-10-31)
- CWE
- CWE-20
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:syncope
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-xgc9-9w4v-h33h | Maven | org.apache.syncope:syncope-core | <1.2.11 | 1.2.11 |
| GHSA-xgc9-9w4v-h33h | Maven | org.apache.syncope:syncope-core | >=2.0.0 <2.0.8 | 2.0.8 |
References
- http://syncope.apache.org/security.html#CVE-2018-1321:_Remote_code_execution_by_administrators_with_report_and_template_entitlements
- http://www.securityfocus.com/bid/103508
- https://www.exploit-db.com/exploits/45400/
- http://syncope.apache.org/security.html#CVE-2018-1321:_Remote_code_execution_by_administrators_with_report_and_template_entitlements
- http://www.securityfocus.com/bid/103508