PT-2018-3348 · Apache · Apache Syncope
Published
2018-03-20
·
Updated
2019-04-25
·
CVE-2018-1321
CVSS v2.0
9.0
High
| Vector | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions:
Apache Syncope versions 1.0.x through 1.2.10
Apache Syncope versions 2.0.x through 2.0.7
Apache Syncope version 1.1.x
Description:
The issue is related to insufficient input validation in the implementation of XSLT technology in Apache Syncope, allowing an administrator with report and template entitlements to perform malicious operations. These operations include file read, file write, and code execution. The vulnerability can be exploited by a remote attacker.
Recommendations:
For Apache Syncope versions 1.0.x through 1.2.10, update to version 1.2.11 or later.
For Apache Syncope versions 2.0.x through 2.0.7, update to version 2.0.8 or later.
For Apache Syncope version 1.1.x, consider upgrading to a supported release, as this version is unsupported.
As a temporary workaround, consider restricting the use of XSL Transformations (XSLT) for administrators with report and template entitlements until a patch is available.
Exploit
Fix
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Apache Syncope