CVE-2018-1321

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

17.68%

Published

Mar 20, 2018

Modified

Nov 21, 2024

Public PoC / Exploit (2)

All weaponized →

Exploit-DBApache Syncope 2.0.7 - Remote Code Execution TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

An administrator with report and template entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can use XSL Transformations (XSLT) to perform malicious operations, including but not limited to file read, file write, and code execution.

Weaknesses (CWE)

CWE-20

Affected Products (19)

apache · syncope (up to 1.2.11)vulnerable

apache · syncope (up to 2.0.8)vulnerable

apache · syncopevulnerable

References (6)

http://syncope.apache.org/security.html#CVE-2018-1321:_Remote_code_execution_by_administrators_with_report_and_template_entitlements

MitigationVendor Advisory

http://www.securityfocus.com/bid/103508

Third Party AdvisoryVDB Entry

https://www.exploit-db.com/exploits/45400/

Third Party AdvisoryVDB Entry

http://syncope.apache.org/security.html#CVE-2018-1321:_Remote_code_execution_by_administrators_with_report_and_template_entitlements

MitigationVendor Advisory

KEV Catalog EPSS Scores Vendors All CVEs