What is GHSA-r2xf-w5pj-9pw8?

GHSA-r2xf-w5pj-9pw8 is a security advisory published by GitHub Security Advisories with Medium severity. Apache Syncope JEXL Code Injection

Which CVE IDs does GHSA-r2xf-w5pj-9pw8 cover?

GHSA-r2xf-w5pj-9pw8 covers the following CVE IDs: CVE-2014-0111. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-r2xf-w5pj-9pw8?

GHSA-r2xf-w5pj-9pw8 affects 2 products, including: maven/org.apache.syncope:syncope:\u003e= 1.0.0, \u003c 1.0.9; maven/org.apache.syncope:syncope:\u003e= 1.1.0, \u003c 1.1.7.

GHSA-r2xf-w5pj-9pw8Medium

Apache Syncope JEXL Code Injection

Vendor

GitHub Security Advisories

Published

May 14, 2022

Last Modified

August 16, 2023

🔗 CVE IDs covered (1)

CVE-2014-0111 →

📋 Description

Apache Syncope 1.0.0 before 1.0.9 and 1.1.0 before 1.1.7 allows remote administrators to execute arbitrary Java code via vectors related to Apache Commons JEXL expressions, "derived schema definition," "user / role templates," and "account links of resource mappings."

🎯 Affected products2

maven/org.apache.syncope:syncope:>= 1.0.0, < 1.0.9
maven/org.apache.syncope:syncope:>= 1.1.0, < 1.1.7

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2014-0111
http://mail-archives.us.apache.org/mod_mbox/www-announce/201404.mbox/%[email protected]%3E
http://syncope.apache.org/security.html
https://web.archive.org/web/20201208163011/http://www.securityfocus.com/archive/1/531841/100/0/threaded
https://github.com/advisories/GHSA-r2xf-w5pj-9pw8