CVE-2018-1322

Published: Mar 20, 2018Modified: Nov 21, 2024

4.9

Vector

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Exploitability: 1.2 / Impact: 3.6

Source: NVD

Description

An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can recover sensitive security values using the fiql and orderby parameters.

Affected (19)

Products: Apache: Syncope

Apache

1 product

Syncope

Configuration A

19 vulnerable

Vulnerable Software	Affected Versions
Apache Syncope	From 1.2.0 to 1.2.11
Apache Syncope	From 2.0.0 to 2.0.8
Apache Syncope	Version 1.0.0
Apache Syncope	Version 1.0.3
Apache Syncope	Version 1.0.4
Apache Syncope	Version 1.0.5
Apache Syncope	Version 1.0.6
Apache Syncope	Version 1.0.7
Apache Syncope	Version 1.0.8
Apache Syncope	Version 1.0.9
Apache Syncope	Version 1.1.0
Apache Syncope	Version 1.1.1
Apache Syncope	Version 1.1.2
Apache Syncope	Version 1.1.3
Apache Syncope	Version 1.1.4
Apache Syncope	Version 1.1.5
Apache Syncope	Version 1.1.6
Apache Syncope	Version 1.1.7
Apache Syncope	Version 1.1.8