Hardcoded credentials

2018-11-0619:29:00

PRIOn knowledge base

www.prio-n.com

5.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

40.0%

JSON

A malicious user with enough administration entitlements can inject html-like elements containing JavaScript statements into Connector names, Report names, AnyTypeClass keys and Policy descriptions. When another user with enough administration entitlements edits one of the Entities above via Admin Console, the injected JavaScript code is executed.

CPENameOperatorVersion
syncopege2.1.0
syncopelt2.1.2
syncopege2.0.0
syncopelt2.0.11

Name	Operator	Version
syncope	ge	2.1.0
syncope	lt	2.1.2
syncope	ge	2.0.0
syncope	lt	2.0.11

References

syncope.apache.org/security