Syncope
Monthly
Incorrect authorization in Apache Syncope allows a delegated administrator who holds only the ClientApp CREATE entitlement to also carry out ClientApp UPDATE operations, with the mirror-image defect wrongly blocking an administrator who legitimately holds the ClientApp UPDATE entitlement - an integrity-only flaw confined to the trusted, authenticated administrative population rather than an anonymous attack path. The flaw affects Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2, and is neutralized by upgrading to 4.0.8 or 4.1.3. There is no public exploit identified at time of analysis, EPSS is low at 0.48% (40th percentile), and CISA's SSVC records Exploitation as 'none' (though Automatable as 'yes'); the NVD-assigned CVSS of 9.8 with PR:N is substantially overstated relative to the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, which reflects an authenticated admin prerequisite and low integrity-only impact.
Stacked SQL injection in Apache Syncope (3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2) allows an authenticated administrator holding adequate entitlements to execute arbitrary SQL against the backend database by supplying malicious content in the unsanitized entityKey and opEvent parameters, which are concatenated into statements that also allow stacked (multi-statement) execution. The vendor assigned a 9.8 score with a PR:N vector, but the explicitly stated gating precondition - a privileged Syncope administrator with the relevant entitlements - means the realistic attack vector is PR:H (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), so unauthenticated or low-privileged users cannot reach the vulnerable code path. Risk signals are otherwise subdued: EPSS is 0.56% (45th percentile), SSVC records Exploitation: none, and no CISA KEV listing or public exploit code has been identified at time of analysis, so exploitation potential scales with the number of privileged operator accounts and the network reachability of the admin console/REST API rather than with mass-scanning activity.
Missing authorization in Apache Syncope (3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2) lets an administrator who holds task-execution entitlements mass-provision or de-provision group members even for groups the administrator is not entitled to manage, because the authorization check binding task execution to group-scoped administration rights is absent. Impact is limited to the integrity of identity/provisioning data - group membership state - rather than confidentiality or availability, and it is only reachable by an already-privileged administrative insider or a compromised admin account. The published CVSS 9.8 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) materially overstates the risk and is inconsistent with both the description and our independent assessment (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N); no public exploit code has been identified at time of analysis, EPSS is 0.58% (46th percentile), and CISA's SSVC records Exploitation: none with Automatable: yes and Technical Impact: total.
Cross-realm authorization bypass in Apache Syncope allows an administrator who already holds delegated entitlements in one Realm to read, through the REST API, the full Connector configuration of a different Realm - including confidential properties - and then effectively clone that Connector instance into the Realm they control. The flaw affects the 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 lines, and is exploitable only by an authenticated delegated administrator, not by anonymous remote users; no public exploit code has been identified at time of analysis, EPSS is a low 0.48% (40th percentile), and CISA's SSVC assessment records Exploitation: none. Note that the published CVSS 9.8 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) overstates the issue: our independent assessment scores it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, i.e. a confidentiality-only privilege-boundary weakness rather than an unauthenticated, integrity- and availability-destroying flaw.
Incorrect authorization in Apache Syncope (3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2) allows an authenticated principal that holds a search entitlement to retrieve identity and entity records outside its authorized realms by issuing a non-recursive search request. The Realms filter that normally constrains results to the requester's permissions can be rendered empty for non-recursive queries, effectively removing the privilege restriction before the search is translated into SQL, Neo4j, or Elasticsearch/OpenSearch queries; recursive searches are not affected. The exposure is backend-agnostic but gated by authentication and an existing search entitlement, so it is a data-confidentiality bypass rather than anonymous remote code execution - no public exploit code has been identified at time of analysis, EPSS is low (0.48%, ~40th percentile), and there is no CISA KEV listing. Vendor fixes are available in 4.0.8 and 4.1.3.
Syncope versions up to 3.0.15 is affected by improper restriction of xml external entity reference (CVSS 4.9).
Reflected XSS in Apache Syncope's Enduser Login page. An attacker that tricks a legitimate user into clicking a malicious link and logging in to Syncope Enduser could steal that user's credentials. [CVSS 6.8 MEDIUM]
Apache Syncope can be configured to store the user password values in the internal database with AES encryption, though this is not the default option. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Apache Syncope's pluggable extension mechanism lets a user holding administrator rights supply custom interface implementations as Groovy classes that are compiled and reloaded at runtime by the Syncope Core, and because that code was not isolated, a malicious administrator can inject Groovy code that executes remotely on the Core instance with the full privileges of the Syncope process, affecting confidentiality, integrity, and availability. The flaw is reachable only by an authenticated administrator (CVSS 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) - unauthenticated or low-privileged users cannot trigger it - and it affects Apache Syncope 3.0.x before 3.0.14 and 4.0.x before 4.0.2. No public exploit code or confirmed active exploitation has been identified at time of analysis; the practical risk is best characterized as access-gated insider or compromised-admin abuse rather than a mass-exploitation threat.
When editing objects in the Syncope Console, incomplete HTML tags could be used to bypass HTML sanitization. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
When editing a user, group or any object in the Syncope Console, HTML tags could be added to any text field and could lead to potential exploits. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In Apache Syncope 2.1.X releases prior to 2.1.7, when the Flowable extension is enabled, an administrator with workflow entitlements can use Shell Service Tasks to perform malicious operations,. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Vulnerability to Server-Side Template Injection on Mail templates for Apache Syncope 2.0.X releases prior to 2.0.15, 2.1.X releases prior to 2.1.6, enabling attackers to inject arbitrary JEXL. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A Server-Side Template Injection was identified in Apache Syncope prior to 2.1.6 enabling attackers to inject arbitrary Java EL expressions, leading to an unauthenticated Remote Code Execution (RCE). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An administrator with workflow definition entitlements can use DTD to perform malicious operations, including but not limited to file read, file write, and code execution. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A malicious user with enough administration entitlements can inject html-like elements containing JavaScript statements into Connector names, Report names, AnyTypeClass keys and Policy descriptions. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can recover sensitive. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An administrator with report and template entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can use XSL. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Apache Syncope 1.1.x before 1.1.8 uses weak random values to generate passwords, which makes it easier for remote attackers to guess the password via a brute force attack. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity.
Apache Syncope 1.0.0 before 1.0.9 and 1.1.0 before 1.1.7 allows remote administrators to execute arbitrary Java code via vectors related to Apache Commons JEXL expressions, "derived schema. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.
Incorrect authorization in Apache Syncope allows a delegated administrator who holds only the ClientApp CREATE entitlement to also carry out ClientApp UPDATE operations, with the mirror-image defect wrongly blocking an administrator who legitimately holds the ClientApp UPDATE entitlement - an integrity-only flaw confined to the trusted, authenticated administrative population rather than an anonymous attack path. The flaw affects Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2, and is neutralized by upgrading to 4.0.8 or 4.1.3. There is no public exploit identified at time of analysis, EPSS is low at 0.48% (40th percentile), and CISA's SSVC records Exploitation as 'none' (though Automatable as 'yes'); the NVD-assigned CVSS of 9.8 with PR:N is substantially overstated relative to the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, which reflects an authenticated admin prerequisite and low integrity-only impact.
Stacked SQL injection in Apache Syncope (3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2) allows an authenticated administrator holding adequate entitlements to execute arbitrary SQL against the backend database by supplying malicious content in the unsanitized entityKey and opEvent parameters, which are concatenated into statements that also allow stacked (multi-statement) execution. The vendor assigned a 9.8 score with a PR:N vector, but the explicitly stated gating precondition - a privileged Syncope administrator with the relevant entitlements - means the realistic attack vector is PR:H (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), so unauthenticated or low-privileged users cannot reach the vulnerable code path. Risk signals are otherwise subdued: EPSS is 0.56% (45th percentile), SSVC records Exploitation: none, and no CISA KEV listing or public exploit code has been identified at time of analysis, so exploitation potential scales with the number of privileged operator accounts and the network reachability of the admin console/REST API rather than with mass-scanning activity.
Missing authorization in Apache Syncope (3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2) lets an administrator who holds task-execution entitlements mass-provision or de-provision group members even for groups the administrator is not entitled to manage, because the authorization check binding task execution to group-scoped administration rights is absent. Impact is limited to the integrity of identity/provisioning data - group membership state - rather than confidentiality or availability, and it is only reachable by an already-privileged administrative insider or a compromised admin account. The published CVSS 9.8 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) materially overstates the risk and is inconsistent with both the description and our independent assessment (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N); no public exploit code has been identified at time of analysis, EPSS is 0.58% (46th percentile), and CISA's SSVC records Exploitation: none with Automatable: yes and Technical Impact: total.
Cross-realm authorization bypass in Apache Syncope allows an administrator who already holds delegated entitlements in one Realm to read, through the REST API, the full Connector configuration of a different Realm - including confidential properties - and then effectively clone that Connector instance into the Realm they control. The flaw affects the 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 lines, and is exploitable only by an authenticated delegated administrator, not by anonymous remote users; no public exploit code has been identified at time of analysis, EPSS is a low 0.48% (40th percentile), and CISA's SSVC assessment records Exploitation: none. Note that the published CVSS 9.8 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) overstates the issue: our independent assessment scores it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, i.e. a confidentiality-only privilege-boundary weakness rather than an unauthenticated, integrity- and availability-destroying flaw.
Incorrect authorization in Apache Syncope (3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2) allows an authenticated principal that holds a search entitlement to retrieve identity and entity records outside its authorized realms by issuing a non-recursive search request. The Realms filter that normally constrains results to the requester's permissions can be rendered empty for non-recursive queries, effectively removing the privilege restriction before the search is translated into SQL, Neo4j, or Elasticsearch/OpenSearch queries; recursive searches are not affected. The exposure is backend-agnostic but gated by authentication and an existing search entitlement, so it is a data-confidentiality bypass rather than anonymous remote code execution - no public exploit code has been identified at time of analysis, EPSS is low (0.48%, ~40th percentile), and there is no CISA KEV listing. Vendor fixes are available in 4.0.8 and 4.1.3.
Syncope versions up to 3.0.15 is affected by improper restriction of xml external entity reference (CVSS 4.9).
Reflected XSS in Apache Syncope's Enduser Login page. An attacker that tricks a legitimate user into clicking a malicious link and logging in to Syncope Enduser could steal that user's credentials. [CVSS 6.8 MEDIUM]
Apache Syncope can be configured to store the user password values in the internal database with AES encryption, though this is not the default option. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Apache Syncope's pluggable extension mechanism lets a user holding administrator rights supply custom interface implementations as Groovy classes that are compiled and reloaded at runtime by the Syncope Core, and because that code was not isolated, a malicious administrator can inject Groovy code that executes remotely on the Core instance with the full privileges of the Syncope process, affecting confidentiality, integrity, and availability. The flaw is reachable only by an authenticated administrator (CVSS 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) - unauthenticated or low-privileged users cannot trigger it - and it affects Apache Syncope 3.0.x before 3.0.14 and 4.0.x before 4.0.2. No public exploit code or confirmed active exploitation has been identified at time of analysis; the practical risk is best characterized as access-gated insider or compromised-admin abuse rather than a mass-exploitation threat.
When editing objects in the Syncope Console, incomplete HTML tags could be used to bypass HTML sanitization. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
When editing a user, group or any object in the Syncope Console, HTML tags could be added to any text field and could lead to potential exploits. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In Apache Syncope 2.1.X releases prior to 2.1.7, when the Flowable extension is enabled, an administrator with workflow entitlements can use Shell Service Tasks to perform malicious operations,. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Vulnerability to Server-Side Template Injection on Mail templates for Apache Syncope 2.0.X releases prior to 2.0.15, 2.1.X releases prior to 2.1.6, enabling attackers to inject arbitrary JEXL. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A Server-Side Template Injection was identified in Apache Syncope prior to 2.1.6 enabling attackers to inject arbitrary Java EL expressions, leading to an unauthenticated Remote Code Execution (RCE). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An administrator with workflow definition entitlements can use DTD to perform malicious operations, including but not limited to file read, file write, and code execution. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A malicious user with enough administration entitlements can inject html-like elements containing JavaScript statements into Connector names, Report names, AnyTypeClass keys and Policy descriptions. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can recover sensitive. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An administrator with report and template entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can use XSL. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Apache Syncope 1.1.x before 1.1.8 uses weak random values to generate passwords, which makes it easier for remote attackers to guess the password via a brute force attack. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity.
Apache Syncope 1.0.0 before 1.0.9 and 1.1.0 before 1.1.7 allows remote administrators to execute arbitrary Java code via vectors related to Apache Commons JEXL expressions, "derived schema. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.