VulnerabilityModified
CVE-2018-1322
An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can recover sensitive security values using the fiql and orderby parameters.
MEDIUM 4.9EPSS 19.8%
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 19.8%, higher than 97% of all known CVEs. Patch or mitigate before the next change window.
Description
An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can recover sensitive security values using the fiql and orderby parameters.
- CVSS 3.0
- 4.9 MEDIUMCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 19.76% probability · 97th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-200
- Affected
- apache/syncope
- Source
- security@apache.org
References
- http://syncope.apache.org/security.html#CVE-2018-1322:_Information_disclosure_via_FIQL_and_ORDER_BY_sortingMitigation, Vendor Advisory
- http://www.securityfocus.com/bid/103507Third Party Advisory, VDB Entry
- https://www.exploit-db.com/exploits/45400/Third Party Advisory, VDB Entry
- http://syncope.apache.org/security.html#CVE-2018-1322:_Information_disclosure_via_FIQL_and_ORDER_BY_sortingMitigation, Vendor Advisory
- http://www.securityfocus.com/bid/103507Third Party Advisory, VDB Entry
- https://www.exploit-db.com/exploits/45400/Third Party Advisory, VDB Entry
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.