CVE-2018-1322

MEDIUM 4.9EPSS 19.9%

An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can recover sensitive security values using the fiql and orderby parameters.

Affected: Apache Software Foundation · Apache Syncope
CVSS v3.0 NVD: 4.9 MEDIUMCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CVSS v2.0 NVD: 4.0 MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N
EPSS: 19.92% chance of exploitation in the next 30 days, 97th percentile
Published: 2018-03-20
Updated: 2024-09-16

ExploitDB entries (1)

https://www.exploit-db.com/exploits/45400

Security advisories

http://syncope.apache.org/security.html#CVE-2018-1322:_Information_disclosure_via_FIQL_an…
http://www.securityfocus.com/bid/103507
advisories/GHSA-v3vf-2r98-xw8w

References

CVE Record
NVD entry