PT-2025-42765 · Apache · Apache Syncope

Mike Cole · Published 2025-08-28 · Updated 2026-04-20 · CVE-2025-57738

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Syncope versions 3.0.0 through 3.0.13 Apache Syncope versions 4.0.0 through 4.0.1

Description Apache Syncope allows a malicious administrator to inject Groovy code that can be executed remotely by a running Apache Syncope Core instance. The software offers the ability to extend its base behavior through custom Java or Groovy interface implementations, with Groovy being attractive due to its runtime reload capability. This feature can be exploited to inject and execute malicious code.

Recommendations Upgrade to Apache Syncope version 3.0.14 Upgrade to Apache Syncope version 4.0.2

Fix

RCE

Weakness Enumeration

CWE-653

Related Identifiers

BDU:2025-13743

CVE-2025-57738

GHSA-825G-MM5V-GGQ4

Affected Products

Apache Syncope

References · 23

• https://bdu.fstec.ru/vul/2025-13743 · Security Note
• https://lists.apache.org/thread/x7cv6xv7z76y49grdr1hgj1pzw5zbby6 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-57738 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-57738 · Security Note
• https://osv.dev/vulnerability/GHSA-825g-mm5v-ggq4 · Vendor Advisory
• https://github.com/apache/syncope/commit/88c2b5b0be9e2ed66007d672e786165bc266e717 · Note
• https://github.com/apache/syncope/commit/8b08c4d5785599a0e38830dcff89738b93f02a16 · Note
• https://twitter.com/BugBountyShorts/status/1980303350970147202 · Twitter Post
• https://t.me/cveNotify/140672 · Telegram Post
• https://t.me/CVEtracker/35304 · Telegram Post
• https://twitter.com/Dinosn/status/2046161913432699024 · Twitter Post
• https://twitter.com/UndercodeNews/status/1980689878485815375 · Twitter Post
• https://twitter.com/oss_security/status/1980275621155471725 · Twitter Post
• https://issues.apache.org/jira/browse/SYNCOPE-1907 · Note
• https://t.me/cveNotify/139437 · Telegram Post