Improper Restriction of XML External Entity Reference in org.apache.syncope:syncope-core

HIGH 7.2CVE-2018-17186 · GHSA-qfjv-998w-q48f · Published 06/11/2018 · updated 17/06/2026

In short

CVE-2018-17186 is a HIGH (CVSS 7.2) vulnerability affecting org.apache.syncope:syncope-core, syncope (apache).
Chance of exploitation in the next 30 days (EPSS): 2.5%, higher than 84.6% of all vulnerabilities.
Fix: update to 2.1.2, 2.0.11 or later.

Package	Affected versions	Patched versions
org.apache.syncope:syncope-core Maven	`≥ 2.1.0, < 2.1.2< 2.0.11`	`2.1.22.0.11`
syncope apache	`≥ 2.0.0, ≤ 2.0.11≥ 2.1.0, ≤ 2.1.2`	No fix yet

Description

An administrator with workflow definition entitlements can use DTD to perform malicious operations, including but not limited to file read, file write, and code execution.

NVD description

An administrator with workflow definition entitlements can use DTD to perform malicious operations, including but not limited to file read, file write, and code execution.

References

nvd.nist.gov/vuln/detail/CVE-2018-17186 · ADVISORY
apache/syncope commit a0f35f4 · WEB
GitHub Advisory GHSA-qfjv-998w-q48f · ADVISORY
syncope.apache.org/security · WEB

More vulnerabilities in org.apache.syncope:syncope-core

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.apache.syncope:syncope-core

Maven

≥ 2.1.0, < 2.1.2< 2.0.11

2.1.22.0.11

syncope

apache

≥ 2.0.0, ≤ 2.0.11≥ 2.1.0, ≤ 2.1.2

No fix yet

Description

An administrator with workflow definition entitlements can use DTD to perform malicious operations, including but not limited to file read, file write, and code execution.

NVD description

An administrator with workflow definition entitlements can use DTD to perform malicious operations, including but not limited to file read, file write, and code execution.

More vulnerabilities in org.apache.syncope:syncope-core

See all →