WaratekVRT Sign in

CVE-2018-1321 Apache Syncope

Affected softwareApache Syncope
Severity7.2 High CVSS 3.0 2 scores
Fixed in1.2.11, 2.0.8
WeaknessImproper input validation (CWE-20)
Published20 Mar 2018
Updated17 Jun 2026

Description

An administrator with report and template entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can use XSL Transformations (XSLT) to perform malicious operations, including but not limited to file read, file write, and code execution.

Exploitation status

Working exploit published

A reviewed exploit catalogue lists ready-to-run exploit code for this CVE.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment no assessment published
  • Indexed PoC 1 indexed Published artifacts you can open, in Exploit-DB; first seen 2018-09-13.
  • EPSS 18% chance in 30 days A model's forecast, not a report of exploitation. Higher than 97% of all scored CVEs.
IndexArtifactStarsFirst seen
Exploit-DB Apache Syncope 2.0.7 - Remote Code Execution 2018-09-13

Waratek protection

Mitigation candidate

A kind of vulnerability Waratek's rules address, with exploit code published or exploitation reported. No rule exists and none is planned yet. The decision below says what we found to build a rule from.

  • Protection none
  • Action unverified
  • Review automated Inferred
  • Record active
Decided by The affected package being open source on Maven, so the fix can be read
Finding This CVE affects an open-source Java library published on Maven Central (Maven packages: org.apache.syncope:syncope-core), so it is squarely in ARMR's territory and the source needed to understand the defect is public. That makes it a candidate for an ARMR patch rule. No rule exists and none is scheduled: the diff between the affected and fixed versions has not been read, and a closer look may find no hook point ARMR can act on.

CVSS

7.2 HIGH v3.0 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.0 7.2 HIGH CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H NVD Primary published
CVSS 2.0 6.5 none AV:N/AC:L/Au:S/C:P/I:P/A:P NVD Primary

Affected software and releases

Maven packages

Affected and fixed versions, from OSV.dev
PackageIntroducedFixedLast affected
org.apache.syncope:syncope-core 0 1.2.11 unbounded
org.apache.syncope:syncope-core 2.0.0 2.0.8 unbounded

Products and versions

2 products, 21 version entries
SourceVendorProductSchemeAffected versions
nvd apache syncope generic 1.0.0 · 1.0.4 · 1.0.5 · 1.0.6 · 1.0.7 · 1.0.8 · 1.0.9 · 1.1.0 · 1.1.1 · 1.1.2 · 1.1.3 · 1.1.4 · 1.1.5 · 1.1.6 · 1.1.7 · 1.1.8 · 1.2.0:milestone1 · ≥ 1.2.0 and ＜ 1.2.11 · ≥ 2.0.0 and ＜ 2.0.8
osv org.apache.syncope syncope-core generic ＜ 1.2.11 · ≥ 2.0.0 and ＜ 2.0.8

References

URLTags
https://github.com/apache/syncope/commit/726231fbf7b817bd2a9467171dcb1c0087c75bc WEB
https://github.com/apache/syncope/commit/ad31479c1c543ac7d26b8c882aa14f6c00c1fd0 WEB
https://github.com/advisories/GHSA-xgc9-9w4v-h33h ADVISORY
https://www.exploit-db.com/exploits/45400 WEB
http://syncope.apache.org/security.html#CVE-2018-1321:_Remote_code_execution_by_administrators_with_report_and_template_entitlements WEB
http://www.securityfocus.com/bid/103508 WEB
https://www.exploit-db.com/exploits/45400/ Third Party Advisory, VDB Entry

Timeline
Published2018-03-20By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.