Improper Restriction of XML External Entity Reference in org.apache.syncope:syncope-core

2018-11-0623:15:46

Google

osv.dev

0.001 Low

EPSS

Percentile

24.1%

JSON

An administrator with workflow definition entitlements can use DTD to perform malicious operations, including but not limited to file read, file write, and code execution.

CPENameOperatorVersion
org.apache.syncope:syncope-coreeq1.1.4
org.apache.syncope:syncope-coreeq1.1.6
org.apache.syncope:syncope-coreeq1.0.7
org.apache.syncope:syncope-coreeq2.0.3
org.apache.syncope:syncope-coreeq1.1.5
org.apache.syncope:syncope-coreeq2.0.0-M4
org.apache.syncope:syncope-coreeq2.0.0.M5
org.apache.syncope:syncope-coreeq1.2.7
org.apache.syncope:syncope-coreeq1.2.10
org.apache.syncope:syncope-coreeq1.0.5

Name	Operator	Version
org.apache.syncope:syncope-core	eq	1.1.4
org.apache.syncope:syncope-core	eq	1.1.6
org.apache.syncope:syncope-core	eq	1.0.7
org.apache.syncope:syncope-core	eq	2.0.3
org.apache.syncope:syncope-core	eq	1.1.5
org.apache.syncope:syncope-core	eq	2.0.0-M4
org.apache.syncope:syncope-core	eq	2.0.0.M5
org.apache.syncope:syncope-core	eq	1.2.7
org.apache.syncope:syncope-core	eq	1.2.10
org.apache.syncope:syncope-core	eq	1.0.5