CVE-2018-1321

State: Published
Severity: Not scored
Published: Mar 20, 2018
Updated: Sep 16, 2024
Reserved: Dec 7, 2017

Description

An administrator with report and template entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can use XSL Transformations (XSLT) to perform malicious operations, including but not limited to file read, file write, and code execution.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
Apache SyncopeApache Software Foundation	Releases prior to 1.2.11, Releases prior to 2.0.8Affected The unsupported Releases 1.0.x, 1.1.x may be also affected.Affected

References

103508vdb-entry
http://syncope.apache.org/security.html#CVE-2018-1321:_Remote_code_execution_by_administrators_with_report_and_template_entitlements
45400exploit

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.