CVE-2018-1321

Published: Mar 20, 2018Modified: Nov 21, 2024

7.2

Vector

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.2 / Impact: 5.9

Source: NVD

Description

An administrator with report and template entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can use XSL Transformations (XSLT) to perform malicious operations, including but not limited to file read, file write, and code execution.

Affected (19)

Products: Apache: Syncope

Apache

1 product

Syncope

Configuration A

19 vulnerable

Vulnerable Software	Affected Versions
Apache Syncope	From 1.2.0 to 1.2.11
Apache Syncope	From 2.0.0 to 2.0.8
Apache Syncope	Version 1.0.0
Apache Syncope	Version 1.0.4
Apache Syncope	Version 1.0.5
Apache Syncope	Version 1.0.6
Apache Syncope	Version 1.0.7
Apache Syncope	Version 1.0.8
Apache Syncope	Version 1.0.9
Apache Syncope	Version 1.1.0
Apache Syncope	Version 1.1.1
Apache Syncope	Version 1.1.2
Apache Syncope	Version 1.1.3
Apache Syncope	Version 1.1.4
Apache Syncope	Version 1.1.5
Apache Syncope	Version 1.1.6
Apache Syncope	Version 1.1.7
Apache Syncope	Version 1.1.8
Apache Syncope	Version 1.2.0 milestone1