PT-2014-3482 · Apache · Apache Syncope+1

Published 2014-04-17 · Updated 2022-05-14 · CVE-2014-0111

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apache Syncope versions 1.0.0 through 1.0.8 Apache Syncope versions 1.1.0 through 1.1.6

Description The issue allows remote administrators to execute arbitrary Java code via vectors related to Apache Commons JEXL expressions, derived schema definition, user/role templates, and account links of resource mappings.

Recommendations For Apache Syncope versions 1.0.0 through 1.0.8, update to version 1.0.9 or later. For Apache Syncope versions 1.1.0 through 1.1.6, update to version 1.1.7 or later.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2014-0111

GHSA-R2XF-W5PJ-9PW8

Affected Products

Apache Commons Jelly

Apache Syncope

References · 7

• http://syncope.apache.org/security.html · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r2xf-w5pj-9pw8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-0111 · Security Note
• http://securityfocus.com/archive/1/531841/100/0/threaded · Note
• https://web.archive.org/web/20201208163011/http://securityfocus.com/archive/1/531841/100/0/threaded · Note
• http://mail-archives.us.apache.org/mod_mbox/www-announce/201404.mbox/%3C534CE273.9020601%40apache.org%3E · Note
• http://mail-archives.us.apache.org/mod_mbox/www-announce/201404.mbox/[e-mail]%3E · Note