SB2018103108 - Multiple vulnerabilities in Apache Syncope

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2018103108

SB2018103108 - Multiple vulnerabilities in Apache Syncope

Published: October 31, 2018

Security Bulletin ID SB2018103108
Severity
Low
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Information disclosure (CVE-ID: CVE-2018-1322)

The vulnerability allows a remote authenticated attacker to gain access to potentially sensitive information.

The vulnerability exists due to unspecified error related to processing of the fiql and orderby parameters. A remote authenticated administrator with user search entitlements can gain unauthorized access to sensitive information on the system.


2) XML injection (CVE-ID: CVE-2018-1321)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper validation of XML data. A remote administrator with report and template entitlements can use XSL Transformations (XSLT) to perform malicious operations, including but not limited to file read, file write, and code execution.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


Remediation

Install update from vendor's website.

References