CVE-2014-0111: Apache Syncope 1.0.0 before 1.0.9 and 1.1.0 before 1.1.7 allows remote administrators to execute arbitrary Java code via vectors related to Apache Commons JEXL…

PriorityP340medium6.5CVSS 2.0

AVNACLAuSCPIPAP

EPSS

3.28%

87.0th percentile

Apache Syncope 1.0.0 before 1.0.9 and 1.1.0 before 1.1.7 allows remote administrators to execute arbitrary Java code via vectors related to Apache Commons JEXL expressions, "derived schema definition," "user / role templates," and "account links of resource mappings."

Affected

2 ranges

Vendor	Product	Version range	Fixed in
apache	syncope	>= 1.0.0 < 1.0.9	1.0.9
apache	syncope	>= 1.1.0 < 1.1.7	1.1.7

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.