PUBLISHED
2025-10-20 15:15
MODIFIED
2025-10-20 15:15
EPSS (Prob. Exploit)
23.19%
Top 2.2%
> DESCRIPTION
Apache Syncope offers the ability to extend / customize the base behavior on every deployment by allowing to provide custom implementations of a few Java interfaces; such implementations can be provided either as Java or Groovy classes, with the latter being particularly attractive as the machinery is set for runtime reload.
Such a feature has been available for a while, but recently it was discovered that a malicious administrator can inject Groovy code that can be executed remotely by a running Apache Syncope Core instance.
Users are recommended to upgrade to version 3.0.14 / 4.0.2, which fix this issue by forcing the Groovy code to run in a sandbox.
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> CWE DETAILED DESCRIPTIONS
CWE-653: Improper Isolation or Compartmentalization - The product does not properly compartmentalize or isolate functionality, processes, or resources that require different privilege levels, rights, or permissions.
> GITHUB SECURITY ADVISORY
GHSA-825g-mm5v-ggq4
HIGH
Apache Syncope allows malicious administrators to inject Groovy code
AFFECTED PACKAGES:
MAVEN / org.apache.syncope.core:syncope-core-spring
>= 4.0.0-M0, < 4.0.2
Fixed in: 4.0.2
MAVEN / org.apache.syncope.core:syncope-core-spring
< 3.0.14
Fixed in: 3.0.14
> HISTORIQUE DES MODIFICATIONS
Première apparition
20/10/2025 15:15
Source: NVD
📊
ENRICHISSEMENT
01/11/2025 06:01
CWE
Champ modifié: Description CWE
Nouvelle valeur:
CWE-653: Improper Isolation or Compartmentalization - The product does not properly compartmentalize or isolate functionality, processes, or resources that require different privilege levels, rights, ...
📊
ENRICHISSEMENT
20/10/2025 16:45
CVEPROJECT
Champ modifié: CVE Project
Total des modifications: 2
Dernière mise à jour: 1 year ago