CVE-2018-1322

2018-03-2100:00:00

apache

www.cve.org

5.4 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

54.9%

JSON

An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can recover sensitive security values using the fiql and orderby parameters.

CNA Affected

[
  {
    "product": "Apache Syncope",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "status": "affected",
        "version": "Releases prior to 1.2.11, Releases prior to 2.0.8"
      },
      {
        "status": "affected",
        "version": "The unsupported Releases 1.0.x, 1.1.x may be also affected."
      }
    ]
  }
]