CVE-2014-0111

Apache Syncope 1.0.0 before 1.0.9 and 1.1.0 before 1.1.7 allows remote administrators to execute arbitrary Java code via vectors related to Apache Commons JEXL expressions, "derived schema definition," "user / role templates," and "account links of resource mappings."
Code Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.5 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:S/C:P/I:P/A:P
redhatCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 76%
VendorProductVersion
apachesyncope
1.0.0 ≤
𝑥
< 1.0.9
apachesyncope
1.1.0 ≤
𝑥
< 1.1.7
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://mail-archives.us.apache.org/mod_mbox/www-announce/201404.mbox/%3C534CE273.9020601%40apache.org%3E
http://syncope.apache.org/security.html
http://www.securityfocus.com/archive/1/531841/100/0/threaded
http://mail-archives.us.apache.org/mod_mbox/www-announce/201404.mbox/%3C534CE273.9020601%40apache.org%3E
http://syncope.apache.org/security.html
http://www.securityfocus.com/archive/1/531841/100/0/threaded