CVE-2018-1322 Exposure of Sensitive Information to an Unauthorized Actor in Apache syncope-cope
MediumCVSS 4.9
EPSS 19.9%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can recover sensitive security values using the fiql and orderby parameters.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.syncope/syncope-core(Maven) | < 1.2.11 | 1.2.11 |
| org.apache.syncope/syncope-core(Maven) | = 1.0.0-RC1-incubating | No fix listed |
| org.apache.syncope/syncope-core(Maven) | = 1.0.0-RC2-incubating | No fix listed |
| org.apache.syncope/syncope-core(Maven) | = 1.0.0-RC3-incubating | No fix listed |
| org.apache.syncope/syncope-core(Maven) | = 1.0.0-incubating | No fix listed |
| org.apache.syncope/syncope-core(Maven) | = 1.0.1-incubating | No fix listed |
| org.apache.syncope/syncope-core(Maven) | = 1.0.2-incubating | No fix listed |
| org.apache.syncope/syncope-core(Maven) | = 1.0.3-incubating | No fix listed |
| org.apache.syncope/syncope-core(Maven) | = 1.0.4 | No fix listed |
| org.apache.syncope/syncope-core(Maven) | = 1.0.5 | No fix listed |
| org.apache.syncope/syncope-core(Maven) | = 1.0.6 | No fix listed |
| org.apache.syncope/syncope-core(Maven) | = 1.0.7 | No fix listed |
| org.apache.syncope/syncope-core(Maven) | = 1.0.8 | No fix listed |
| org.apache.syncope/syncope-core(Maven) | = 1.0.9 | No fix listed |
| org.apache.syncope/syncope-core(Maven) | = 1.1.0 | No fix listed |
| org.apache.syncope/syncope-core(Maven) | = 1.1.1 | No fix listed |
| org.apache.syncope/syncope-core(Maven) | = 1.1.2 | No fix listed |
| org.apache.syncope/syncope-core(Maven) | = 1.1.3 | No fix listed |
| org.apache.syncope/syncope-core(Maven) | = 1.1.4 | No fix listed |
| org.apache.syncope/syncope-core(Maven) | = 1.1.5 | No fix listed |
| org.apache.syncope/syncope-core(Maven) | = 1.1.6 | No fix listed |
| org.apache.syncope/syncope-core(Maven) | = 1.1.7 | No fix listed |
| org.apache.syncope/syncope-core(Maven) | = 1.1.8 | No fix listed |
| org.apache.syncope/syncope-core(Maven) | = 1.2.0 | No fix listed |
| org.apache.syncope/syncope-core(Maven) | = 1.2.0-M1 | No fix listed |
Show 40 more
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.syncope/syncope-core(Maven) | = 1.2.1 | No fix listed |
| org.apache.syncope/syncope-core(Maven) | = 1.2.10 | No fix listed |
| org.apache.syncope/syncope-core(Maven) | = 1.2.2 | No fix listed |
| org.apache.syncope/syncope-core(Maven) | = 1.2.3 | No fix listed |
| org.apache.syncope/syncope-core(Maven) | = 1.2.4 | No fix listed |
| org.apache.syncope/syncope-core(Maven) | = 1.2.5 | No fix listed |
| org.apache.syncope/syncope-core(Maven) | = 1.2.6 | No fix listed |
| org.apache.syncope/syncope-core(Maven) | = 1.2.7 | No fix listed |
| org.apache.syncope/syncope-core(Maven) | = 1.2.8 | No fix listed |
| org.apache.syncope/syncope-core(Maven) | = 1.2.9 | No fix listed |
| org.apache.syncope/syncope-core(Maven) | >= 2.0.0, < 2.0.8 | 2.0.8 |
| org.apache.syncope/syncope-core(Maven) | = 2.0.0 | No fix listed |
| org.apache.syncope/syncope-core(Maven) | = 2.0.1 | No fix listed |
| org.apache.syncope/syncope-core(Maven) | = 2.0.2 | No fix listed |
| org.apache.syncope/syncope-core(Maven) | = 2.0.3 | No fix listed |
| org.apache.syncope/syncope-core(Maven) | = 2.0.4 | No fix listed |
| org.apache.syncope/syncope-core(Maven) | = 2.0.5 | No fix listed |
| org.apache.syncope/syncope-core(Maven) | = 2.0.6 | No fix listed |
| org.apache.syncope/syncope-core(Maven) | = 2.0.7 | No fix listed |
| apache syncope | >= 1.2.0, < 1.2.11 | 1.2.11 |
| apache syncope | >= 2.0.0, < 2.0.8 | 2.0.8 |
| apache syncope | = 1.0.0 | No fix listed |
| apache syncope | = 1.0.3 | No fix listed |
| apache syncope | = 1.0.4 | No fix listed |
| apache syncope | = 1.0.5 | No fix listed |
| apache syncope | = 1.0.6 | No fix listed |
| apache syncope | = 1.0.7 | No fix listed |
| apache syncope | = 1.0.8 | No fix listed |
| apache syncope | = 1.0.9 | No fix listed |
| apache syncope | = 1.1.0 | No fix listed |
| apache syncope | = 1.1.1 | No fix listed |
| apache syncope | = 1.1.2 | No fix listed |
| apache syncope | = 1.1.3 | No fix listed |
| apache syncope | = 1.1.4 | No fix listed |
| apache syncope | = 1.1.5 | No fix listed |
| apache syncope | = 1.1.6 | No fix listed |
| apache syncope | = 1.1.7 | No fix listed |
| apache syncope | = 1.1.8 | No fix listed |
| Apache Syncope | = Releases prior to 1.2.11, Releases prior to 2.0.8 | No fix listed |
| Apache Syncope | = The unsupported Releases 1.0.x, 1.1.x may be also affected. | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- github.com vendor-advisory
- github.com product
- 45400 exploit third-party-advisory vdb-entry
- syncope.apache.org mitigation vendor-advisory
- 103507 third-party-advisory vdb-entry