PT-2018-11701

CVE-2018-1322

·

Published

2018-03-20

·

Updated

2019-03-08

Description by

CVSS 3.1
4.9
Medium
MetricsAV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions Apache Syncope versions 1.0.x through 1.2.10 Apache Syncope versions 2.0.x through 2.0.7
Description An administrator with user search entitlements can recover sensitive security values using the fiql and orderby parameters.
Recommendations For Apache Syncope versions 1.0.x through 1.2.10, update to version 1.2.11 or later. For Apache Syncope versions 2.0.x through 2.0.7, update to version 2.0.8 or later.
Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Weakness enumeration
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Related identifiers
CVE-2018-1322
GHSA-V3VF-2R98-XW8W
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com