Expression Language Injection in Apache Syncope

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2020-1959 · ADVISORY
• syncope.apache.org/security · WEB

org.apache.syncope:syncope-core のその他の脆弱性

• CVE-2025-65998高 7.5Apache Syncope can be configured to store the user password values in the internal database with AES encryption, though this is not the defa…
• CVE-2020-1961緊急 9.8Vulnerability to Server-Side Template Injection on Mail templates for Apache Syncope 2.0.X releases prior to 2.0.15, 2.1.X releases prior to…
• CVE-2018-17186高 7.2An administrator with workflow definition entitlements can use DTD to perform malicious operations, including but not limited to file read, …
• CVE-2018-17184中 5.4A malicious user with enough administration entitlements can inject html-like elements containing JavaScript statements into Connector names…
• CVE-2018-1322中 4.9An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and…