GHSA-73f3-rqqf-2j54

Suggest an improvement
Source
https://github.com/advisories/GHSA-73f3-rqqf-2j54
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-73f3-rqqf-2j54/GHSA-73f3-rqqf-2j54.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-73f3-rqqf-2j54
Published
2026-02-03T18:30:44Z
Modified
2026-02-03T20:02:37.296670Z
Severity
  • 4.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Apache Syncope: Console XXE on Keymaster parameters
Details

Improper Restriction of XML External Entity Reference vulnerability in Apache Syncope Console. An administrator with adequate entitlements to create or edit Keymaster parameters via Console can construct malicious XML text to launch an XXE attack, thereby causing sensitive data leakage occurs.

This issue affects Apache Syncope: from 3.0 through 3.0.15, from 4.0 through 4.0.3.

Users are recommended to upgrade to version 3.0.16 / 4.0.4, which fix this issue.

Database specific 
{
    "cwe_ids": [
        "CWE-611"
    ],
    "github_reviewed_at": "2026-02-03T19:53:38Z",
    "nvd_published_at": "2026-02-03T16:16:13Z",
    "severity": "MODERATE",
    "github_reviewed": true
}
References

Affected packages

Maven
org.apache.syncope.client.idrepo:syncope-client-idrepo-console

Package

Name
org.apache.syncope.client.idrepo:syncope-client-idrepo-console
View open source insights on deps.dev
Purl
pkg:maven/org.apache.syncope.client.idrepo/syncope-client-idrepo-console

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.0.0
Fixed
3.0.16

Affected versions

3.*
3.0.0
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.0.8
3.0.9
3.0.10
3.0.11
3.0.12
3.0.13
3.0.14
3.0.15

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-73f3-rqqf-2j54/GHSA-73f3-rqqf-2j54.json"
org.apache.syncope.client.idrepo:syncope-client-idrepo-console

Package

Name
org.apache.syncope.client.idrepo:syncope-client-idrepo-console
View open source insights on deps.dev
Purl
pkg:maven/org.apache.syncope.client.idrepo/syncope-client-idrepo-console

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.0.0
Fixed
4.0.4

Affected versions

4.*
4.0.0
4.0.1
4.0.2
4.0.3

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-73f3-rqqf-2j54/GHSA-73f3-rqqf-2j54.json"