Vulnerability Database

299,038

Total vulnerabilities in the database

CVE-2018-1322

An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can recover sensitive security values using the fiql and orderby parameters.

CVSS v3:

  • Severity: Low
  • Score: 4.9
  • AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

CVSS v2:

  • Severity: Low
  • Score: 4
  • AV:N/AC:L/Au:S/C:P/I:N/A:N

CWEs:

Software From Fixed in
apache / syncope 1.1.6 1.1.6.x
apache / syncope 1.0.7 1.0.7.x
apache / syncope 1.0.5 1.0.5.x
apache / syncope 1.1.3 1.1.3.x
apache / syncope 1.0.6 1.0.6.x
apache / syncope 1.1.1 1.1.1.x
apache / syncope 1.1.5 1.1.5.x
apache / syncope 1.0.0 1.0.0.x
apache / syncope 1.0.8 1.0.8.x
apache / syncope 1.1.0 1.1.0.x
apache / syncope 1.0.3 1.0.3.x
apache / syncope 1.1.2 1.1.2.x
apache / syncope 1.1.4 1.1.4.x
apache / syncope 1.1.7 1.1.7.x
apache / syncope 1.0.4 1.0.4.x
apache / syncope 2.0.0 2.0.8
apache / syncope 1.2.0 1.2.11
apache / syncope 1.0.9 1.0.9.x
apache / syncope 1.1.8 1.1.8.x
Maven icon org.apache.syncope / syncope-core - 1.2.11
Maven icon org.apache.syncope / syncope-core 2.0.0 2.0.8