CVE-2025-57738

Apache Syncope offers the ability to extend / customize the base behavior on every deployment by allowing to provide custom implementations of a few Java interfaces; such implementations can be provided either as Java or Groovy classes, with the latter being particularly attractive as the machine...

CVE-2025-57738 Apache Syncope: Remote Code Execution by delegated administrators

Apache Syncope offers the ability to extend / customize the base behavior on every deployment by allowing to provide custom implementations of a few Java interfaces; such implementations can be provided either as Java or Groovy classes, with the latter being particularly attractive as the machine...

org.apache.syncope.core.am:syncope-core-am-logic (>=4.0.0-m0, <=4.0.1), org.apache.syncope.core.am:syncope-core-am-rest-cxf (>=4.0.0-m0, <=4.0.1) +32 more potentially affected by CVE-2025-57738 via org.apache.syncope.core:syncope-core-spring (>=4.0.0-m0, <=4.0.1)

org.apache.syncope.core:syncope-core-spring MAVEN version =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.1 and more Source cves: CVE-...

org.apache.syncope.core.am:syncope-core-am-logic (>=3.0.0-m0, <=3.0.13), org.apache.syncope.core.am:syncope-core-am-rest-cxf (>=3.0.0-m0, <=3.0.13) +46 more potentially affected by CVE-2025-57738 via org.apache.syncope.core:syncope-core-spring (>=2.0.0-m2, <=3.0.13)

org.apache.syncope.core:syncope-core-spring MAVEN version =2.0.0-m2, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =2.0.0-m2, =2.0.0-m3, =2.0.0-m2, =2.1.3, =2.0.0-m2, =2.0.0-m2, =3.0.0-m0, =3.0.0-m0, =2.0.0-m2, =2.0.16 and more Source cves:...

CVE-2025-57738 Apache Syncope: Remote Code Execution by delegated administrators

Apache Syncope offers the ability to extend / customize the base behavior on every deployment by allowing to provide custom implementations of a few Java interfaces; such implementations can be provided either as Java or Groovy classes, with the latter being particularly attractive as the machine...

CVE-2025-57738

Apache Syncope is vulnerable to Remote Code Execution (RCE) due to improper isolation or compartmentalization of custom Groovy implementations. A malicious administrator can inject Groovy code that is loaded and executed by a running Apache Syncope Core instance at runtime, leading to arbitrary c...

CVE-2025-57738 Apache Syncope: Remote Code Execution by delegated administrators

Apache Syncope offers the ability to extend / customize the base behavior on every deployment by allowing to provide custom implementations of a few Java interfaces; such implementations can be provided either as Java or Groovy classes, with the latter being particularly attractive as the machine...

CVE-2025-57738

Apache Syncope offers the ability to extend / customize the base behavior on every deployment by allowing to provide custom implementations of a few Java interfaces; such implementations can be provided either as Java or Groovy classes, with the latter being particularly attractive as the machine...

CVE-2025-57738: Improper Isolation or Compartmentalization

Apache Syncope offers the ability to extend / customize the base behavior on every deployment by allowing to provide custom implementations of a few Java interfaces; such implementations can be provided either as Java or Groovy classes, with the latter being particularly attractive as the machine...

Apache Syncope security vulnerability

Apache Syncope is an open source digital identity management system from the Apache USA Foundation for use in enterprise environments. The system supports identity management, role configuration, and more. A security vulnerability exists in Apache Syncope versions 3.0.14 and 4.0.2, which stems fr...

EUVD-2021-1367

Malware in sbrugna...

EUVD-2021-1411

Malware in sbrugna...

EUVD-2021-1261

Malware in sbrugna...

EUVD-2022-2354

Malicious code in bioql PyPI...

EUVD-2022-0485

Malicious code in bioql PyPI...

EUVD-2022-5072

Malicious code in bioql PyPI...

PT-2025-42765

Name of the Vulnerable Software and Affected Versions Apache Syncope versions 3.0.0 through 3.0.13 Apache Syncope versions 4.0.0 through 4.0.1 Description Apache Syncope allows a malicious administrator to inject Groovy code that can be executed remotely by a running Apache Syncope Core instance...

CVE-2020-1959

A Server-Side Template Injection was identified in Apache Syncope prior to 2.1.6 enabling attackers to inject arbitrary Java EL expressions, leading to an unauthenticated Remote Code Execution RCE vulnerability. Apache Syncope uses Java Bean Validation JSR 380 custom constraint validators. When...

CVE-2020-1961

Vulnerability to Server-Side Template Injection on Mail templates for Apache Syncope 2.0.X releases prior to 2.0.15, 2.1.X releases prior to 2.1.6, enabling attackers to inject arbitrary JEXL expressions, leading to Remote Code Execution RCE was discovered...

CVE-2020-11977

In Apache Syncope 2.1.X releases prior to 2.1.7, when the Flowable extension is enabled, an administrator with workflow entitlements can use Shell Service Tasks to perform malicious operations, including but not limited to file read, file write, and code execution...