CVE-2018-1321
High severity vulnerability that affects org.apache.syncope:syncope-core
An administrator with report and template entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can use XSL Transformations (XSLT) to perform malicious operations, including but not limited to file read, file write, and code execution.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An administrator with report and template entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can use XSL Transformations (XSLT) to perform malicious operations, including but not limited to file read, file write, and code execution.
- Record
CVE-2018-1321- CVSS 3.0
- 7.2 High
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
An administrator with report and template entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can use XSL Transformations (XSLT) to perform malicious operations, including but not limited to file read, file write, and code execution.
- Record
CVE-2018-1321- Updated
- 2026-11-02
EUVDEUVD-2018-0788 No score
An administrator with report and template entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can use XSL Transformations (XSLT) to perform malicious operations, including but not limited to file read, file write, and code execution.
- Record
EUVD-2018-0788- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xgc9-9w4v-h33h
High severity vulnerability that affects org.apache.syncope:syncope-core
An administrator with report and template entitlements in Apache Syncope 1.2.x before 1.2.11 and 2.0.x before 2.0.8 can use XSL Transformations (XSLT) to perform malicious operations, including but not limited to file read, file write, and code execution.
- Record
GHSA-xgc9-9w4v-h33h- CVSS 3.0
- 7.2 High
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
An administrator with report and template entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can use XSL Transformations (XSLT) to perform malicious operations, including but not limited to file read, file write, and code execution.
- Record
CVE-2018-1321- CVSS 3.0
- 7.2 High
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-xgc9-9w4v-h33h
High severity vulnerability that affects org.apache.syncope:syncope-core
An administrator with report and template entitlements in Apache Syncope 1.2.x before 1.2.11 and 2.0.x before 2.0.8 can use XSL Transformations (XSLT) to perform malicious operations, including but not limited to file read, file write, and code execution.
- Record
GHSA-xgc9-9w4v-h33h- CVSS 3.0
- 7.2 High
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.syncope:syncope-coreMaven |
before 1.2.11 | 1.2.11 |
org.apache.syncope:syncope-coreMaven |
2.0.0 up to 2.0.8 | 2.0.8 |
org.apache.syncope:syncope-coreMaven |
before 1.2.11, plus listed versions 1.0.0-RC1-incubating1.0.0-RC2-incubating1.0.0-RC3-incubating1.0.0-incubating1.0.1-incubating Show 29 moreShow less1.0.2-incubating1.0.3-incubating1.0.41.0.51.0.61.0.71.0.81.0.91.1.01.1.11.1.21.1.31.1.41.1.51.1.61.1.71.1.81.2.01.2.0-M11.2.11.2.101.2.21.2.31.2.41.2.51.2.61.2.71.2.81.2.9 |
1.2.11 |
org.apache.syncope:syncope-coreMaven |
2.0.0 up to 2.0.8, plus listed versions 2.0.12.0.22.0.32.0.42.0.52.0.62.0.7 |
2.0.8 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Apache Syncope 2.0.7 - Remote Code Execution | 2018-09-13 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-1321 is a high vulnerability (CVSS 7.2) in Apache Syncope, published March 20, 2018. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 17.5%, the 97th percentile. Fixed in org.apache.syncope:syncope-core 1.2.11.
References
securityfocus.com/bid/103508
syncope.apache.org/security.html
exploit-db.com/exploits/45400
nvd.nist.gov/vuln/detail/CVE-2018-1321
github.com/advisories/GHSA-xgc9-9w4v-h33h