Aleksandar Djordjevic

**Name of the Vulnerable Software and Affected Versions** Apache Pulsar Manager versions 0.1.0 through 0.4.0 **Description** Apache Pulsar Manager contains several security flaws. The process for creating the initial administrator account is accessible without authentication and remains available after initialization, allowing any network-reachable user to create an administrator account. In versions 0.3.0 and later, the software does not distinguish between privilege levels, granting all accounts full administrative rights. Additionally, requests proxied to the Pulsar admin API bypass authentication, enabling unauthenticated users to perform administrative operations using the configured credentials. Furthermore, a requester can specify the destination of a proxied request, causing Pulsar Manager to send its configured admin credentials to an arbitrary host. If configured with a token signing key, a Pulsar Manager administrator can generate tokens for the cluster. **Recommendations** Stop using Apache Pulsar Manager and remove all existing deployments. Replace any Pulsar credentials or token signing keys that were used in Pulsar Manager configurations. Restrict network access to trusted administrators and do not expose the software to untrusted networks until it is removed.

**Name of the Vulnerable Software and Affected Versions** Apache Syncope versions 3.0.0-M0 through 3.0.16 Apache Syncope versions 4.0.0-M0 through 4.0.7 Apache Syncope versions 4.1.0-M0 through 4.1.2 **Description** An incorrect authorization issue exists in the delegated administration security checks, which rely on Realm hierarchy and prefix matches. Because of an implementation error, the system cannot distinguish between two sibling Realms if their names start with the same string, leading to unauthorized access. **Recommendations** Upgrade versions 3.0.0-M0 through 3.0.16 to version 4.0.8 or 4.1.3. Upgrade versions 4.0.0-M0 through 4.0.7 to version 4.0.8 or 4.1.3. Upgrade versions 4.1.0-M0 through 4.1.2 to version 4.1.3.