Follycat

**Name of the Vulnerable Software and Affected Versions** Apache Syncope versions 3.0.0-M0 through 3.0.16 Apache Syncope versions 4.0.0-M0 through 4.0.6 Apache Syncope versions 4.1.0-M0 through 4.1.1 **Description** An improper isolation issue allows an administrator with sufficient entitlements to import arbitrary BPMN process definitions via the REST API and initiate the process. If the imported BPMN process contains a Groovy `scriptTask`, the script is executed directly on the server without a sandbox, potentially leading to arbitrary code execution. **Recommendations** Upgrade versions 3.0.0-M0 through 3.0.16 to version 4.0.7. Upgrade versions 4.0.0-M0 through 4.0.6 to version 4.0.7. Upgrade versions 4.1.0-M0 through 4.1.1 to version 4.1.2.

**Name of the Vulnerable Software and Affected Versions** Apache Syncope versions 3.0.0-M0 through 3.0.16 Apache Syncope versions 4.0.0-M0 through 4.0.6 Apache Syncope versions 4.1.0-M0 through 4.1.1 **Description** Improper isolation or compartmentalization in the connector subsystem allows an administrator with adequate entitlements to achieve remote code execution. This is possible by leveraging the capability of scripted connectors, specifically REST and SQL, to execute Groovy scripts. **Recommendations** Upgrade versions 3.0.0-M0 through 3.0.16 to version 4.0.7. Upgrade versions 4.0.0-M0 through 4.0.6 to version 4.0.7. Upgrade versions 4.1.0-M0 through 4.1.1 to version 4.1.2.

**Name of the Vulnerable Software and Affected Versions** Apache Syncope versions 3.0 through 3.0.15 Apache Syncope versions 4.0 through 4.0.3 **Description** An issue exists in Apache Syncope Console where an administrator with sufficient privileges to create or edit Keymaster parameters can construct malicious XML text to launch an XML External Entity (XXE) attack. This can lead to sensitive data leakage. **Recommendations** Upgrade to Apache Syncope version 3.0.16 Upgrade to Apache Syncope version 4.0.4