Exposure of Sensitive Information to an Unauthorized Actor in Apache syncope-cope

中 4.9CVE-2018-1322 · GHSA-v3vf-2r98-xw8w · 20/03/2018 公開 · 17/06/2026 更新

パッケージ	影響を受けるバージョン	修正済みバージョン
org.apache.syncope:syncope-core Maven	`≥ 2.0.0, < 2.0.8< 1.2.11`	`2.0.81.2.11`
syncope apache	`= 1.0.0= 1.0.3= 1.0.4= 1.0.5= 1.0.6= 1.0.7= 1.0.8= 1.0.9= 1.1.0= 1.1.1= 1.1.2= 1.1.3= 1.1.4= 1.1.5= 1.1.6= 1.1.7= 1.1.8≥ 1.2.0, < 1.2.11≥ 2.0.0, < 2.0.8`	`1.2.112.0.8`

概要

An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11 and 2.0.x before 2.0.8 can recover sensitive security values using the fiql and orderby parameters.

NVD の説明

An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can recover sensitive security values using the fiql and orderby parameters.

参考情報

nvd.nist.gov/vuln/detail/CVE-2018-1322 · ADVISORY
apache/syncope commit 44a5ca0 · WEB
apache/syncope commit 735579b · WEB
GitHub Advisory GHSA-v3vf-2r98-xw8w · ADVISORY
apache/syncope · PACKAGE
exploit-db.com/exploits/45400 · WEB
syncope.apache.org/security.html · WEB
securityfocus.com/bid/103507 · WEB
exploit-db.com/exploits/45400 · Third Party Advisory

これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。

無料でサイトをスキャン

パッケージ

影響を受けるバージョン

修正済みバージョン

org.apache.syncope:syncope-core

Maven

≥ 2.0.0, < 2.0.8< 1.2.11

2.0.81.2.11

syncope

apache

= 1.0.0= 1.0.3= 1.0.4= 1.0.5= 1.0.6= 1.0.7= 1.0.8= 1.0.9= 1.1.0= 1.1.1= 1.1.2= 1.1.3= 1.1.4= 1.1.5= 1.1.6= 1.1.7= 1.1.8≥ 1.2.0, < 1.2.11≥ 2.0.0, < 2.0.8

1.2.112.0.8

概要

An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11 and 2.0.x before 2.0.8 can recover sensitive security values using the fiql and orderby parameters.

NVD の説明