PT-2014-3482 · Apache · Apache Syncope+1

Publicado 2014-04-17 · Atualizado 2022-05-14 · CVE-2014-0111

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apache Syncope versions 1.0.0 through 1.0.8 Apache Syncope versions 1.1.0 through 1.1.6

Description The issue allows remote administrators to execute arbitrary Java code via vectors related to Apache Commons JEXL expressions, derived schema definition, user/role templates, and account links of resource mappings.

Recommendations For Apache Syncope versions 1.0.0 through 1.0.8, update to version 1.0.9 or later. For Apache Syncope versions 1.1.0 through 1.1.6, update to version 1.1.7 or later.

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2014-0111

GHSA-R2XF-W5PJ-9PW8

Produtos afetados

Apache Commons Jelly

Apache Syncope

Referências · 7

• http://securityfocus.com/archive/1/531841/100/0/threaded · Nota
• http://syncope.apache.org/security.html · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-r2xf-w5pj-9pw8 · Aviso do Fabricante
• https://web.archive.org/web/20201208163011/http://securityfocus.com/archive/1/531841/100/0/threaded · Nota
• http://mail-archives.us.apache.org/mod_mbox/www-announce/201404.mbox/%3C534CE273.9020601%40apache.org%3E · Nota
• http://mail-archives.us.apache.org/mod_mbox/www-announce/201404.mbox/[e-mail]%3E · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-0111 · Nota de Segurança