CVE-2018-1321

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2018-1321
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-1321.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2018-1321
Aliases
Published
2018-03-20T17:29:00.267Z
Modified
2026-04-10T04:05:18.248844Z
Severity
  • 7.2 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

An administrator with report and template entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can use XSL Transformations (XSLT) to perform malicious operations, including but not limited to file read, file write, and code execution.

References

Affected packages

Git / github.com/apache/syncope

Affected ranges

Type
GIT
Repo
https://github.com/apache/syncope
Events
Introduced
c4c9de1b34920110f6c0e4feaf62e1d197ec872b
Fixed
1583964bffaf14ec90641a11523bb75aef8097e3
Introduced
973afc777d2f8093785875c62e808d97334fb2e3
Fixed
7a012b5de2f91fc056eb8a8a14c720ea91bfaf58
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
f198eed905720cce150cafb4e2a874deee8dc016
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
8b62a2e923ab2fab44ce2538eb2c21aa5f6475b7
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
ff38cce6001be2beab8f473c10fde16fd6b630b0
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
b9bda1e152b716a0c158c4df60fadcbacc1edbff
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
92686fd8dec67102e69ea92e2d6e6dfba4bb2cd4
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
67ecd5e5ba49af8f3404308d16fc54b93723c784
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
9e63009b8f776d4a1f3ed0093e356b52e8be7fdc
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
87094b50b419964179136173e558cb8be631992f
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
e4f5338b36b683869d1aa24f1b3c3177800f2e40
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
437247062d334a4d61c6fbfddabe412c7a765be3
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
0381734dfaf6c7abc0a47d7cf53ac9870d2ee742
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
aa3ee89288a0addadddbf07664a07895423c6c20
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
d8df634720e387d5d8678d173d8d0e4cbad1b70d
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
ab5259eb5bee4235860ebdb54ff98e9e57e95d26
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
fc285bb21589439233c4fbc879cdfac302cda124
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
2836c57936c1c166a2aa14c8842f7a5832b82695
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
48b3b895c73848ffed7d9d5af3dab09b16c4d8ca
Database specific 
{
    "versions": [
        {
            "introduced": "1.2.0"
        },
        {
            "fixed": "1.2.11"
        },
        {
            "introduced": "2.0.0"
        },
        {
            "fixed": "2.0.8"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.0.0"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.0.4"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.0.5"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.0.6"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.0.7"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.0.8"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.0.9"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.1.0"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.1.1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.1.2"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.1.3"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.1.4"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.1.5"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.1.6"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.1.7"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.1.8"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.2.0-milestone1"
        }
    ]
}

Affected versions

syncope-1.*
syncope-1.0.0-incubating
syncope-1.0.4
syncope-1.0.5
syncope-1.0.6
syncope-1.0.7
syncope-1.0.8
syncope-1.0.9
syncope-1.1.0-SNAPSHOT-before-role-provisioning
syncope-1.1.1
syncope-1.1.2
syncope-1.1.3
syncope-1.1.4
syncope-1.1.5
syncope-1.1.6
syncope-1.1.7
syncope-1.1.8
syncope-1.2.0-M1
syncope-1.2.1
syncope-1.2.10
syncope-1.2.2
syncope-1.2.3
syncope-1.2.4
syncope-1.2.5
syncope-1.2.6
syncope-1.2.7
syncope-1.2.8
syncope-1.2.9
syncope-2.*
syncope-2.0.0
syncope-2.0.1
syncope-2.0.2
syncope-2.0.3
syncope-2.0.4
syncope-2.0.5
syncope-2.0.6
syncope-2.0.7

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-1321.json"