CVE-2018-1321
An administrator with report and template entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can use XSL Transformations (XSLT) to perform malicious operations,…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 17.4%, higher than 97% of all known CVEs. Patch or mitigate before the next change window.
Description
An administrator with report and template entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can use XSL Transformations (XSLT) to perform malicious operations, including but not limited to file read, file write, and code execution.
- CVSS 3.0
- 7.2 HIGHCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 17.39% probability · 97th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-20
- Affected
- apache/syncope
- Source
- security@apache.org
References
- http://syncope.apache.org/security.html#CVE-2018-1321:_Remote_code_execution_by_administrators_with_report_and_template_entitlementsMitigation, Vendor Advisory
- http://www.securityfocus.com/bid/103508Third Party Advisory, VDB Entry
- https://www.exploit-db.com/exploits/45400/Third Party Advisory, VDB Entry
- http://syncope.apache.org/security.html#CVE-2018-1321:_Remote_code_execution_by_administrators_with_report_and_template_entitlementsMitigation, Vendor Advisory
- http://www.securityfocus.com/bid/103508Third Party Advisory, VDB Entry
- https://www.exploit-db.com/exploits/45400/Third Party Advisory, VDB Entry
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.