CVE-2018-1322
Exposure of Sensitive Information to an Unauthorized Actor in Apache syncope-cope
CVE-2018-1322 is a medium vulnerability (CVSS 4.9) in Apache Syncope, published March 20, 2018. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 19.9%, the 97th percentile. Fixed in org.apache.syncope:syncope-core 1.2.11.
- Severity
- 4.9 MediumCVSS 3.0, NVD
- Exploit chance
- 19.9%EPSS, 97th percentile
- Exploitation
- None known1 public exploit
- Fixed in
1.2.11org.apache.syncope:syncope-core +3 more
Description
An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can recover sensitive security values using the fiql and orderby parameters.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.syncope:syncope-coreMaven | before 1.2.11 | 1.2.11 |
org.apache.syncope:syncope-coreMaven | 2.0.0 up to 2.0.8 | 2.0.8 |
org.apache.syncope:syncope-coreMaven | before 1.2.11, plus listed versions 1.0.0-RC1-incubating1.0.0-RC2-incubating1.0.0-RC3-incubating1.0.0-incubating1.0.1-incubating Show 29 moreShow less1.0.2-incubating1.0.3-incubating1.0.41.0.51.0.61.0.71.0.81.0.91.1.01.1.11.1.21.1.31.1.41.1.51.1.61.1.71.1.81.2.01.2.0-M11.2.11.2.101.2.21.2.31.2.41.2.51.2.61.2.71.2.81.2.9 | 1.2.11 |
org.apache.syncope:syncope-coreMaven | 2.0.0 up to 2.0.8, plus listed versions 2.0.12.0.22.0.32.0.42.0.52.0.62.0.7 | 2.0.8 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Apache Syncope 2.0.7 - Remote Code Execution | 2018-09-13 |
What each source reports
NVD Score used
An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can recover sensitive security values using the fiql and orderby parameters.
- Record
CVE-2018-1322- CVSS 3.0
- 4.9 Medium
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE ListNo score
An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can recover sensitive security values using the fiql and orderby parameters.
- Record
CVE-2018-1322- Updated
- 2026-11-02
EUVDEUVD-2018-0778No score
An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can recover sensitive security values using the fiql and orderby parameters.
- Record
EUVD-2018-0778- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-v3vf-2r98-xw8w
Exposure of Sensitive Information to an Unauthorized Actor in Apache syncope-cope
An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11 and 2.0.x before 2.0.8 can recover sensitive security values using the fiql and orderby parameters.
- Record
GHSA-v3vf-2r98-xw8w- CVSS 3.0
- 4.9 Medium
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSV
An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can recover sensitive security values using the fiql and orderby parameters.
- Record
CVE-2018-1322- CVSS 3.0
- 4.9 Medium
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVGHSA-v3vf-2r98-xw8w
Exposure of Sensitive Information to an Unauthorized Actor in Apache syncope-cope
An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11 and 2.0.x before 2.0.8 can recover sensitive security values using the fiql and orderby parameters.
- Record
GHSA-v3vf-2r98-xw8w- CVSS 3.0
- 4.9 Medium
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
syncope.apache.org/security.html
securityfocus.com/bid/103507
exploit-db.com/exploits/45400
nvd.nist.gov/vuln/detail/CVE-2018-1322
github.com/advisories/GHSA-v3vf-2r98-xw8w