Evil-DB LogoEvil-DB
← All CVEs

CVE-2018-1322

medium · 4.9

An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can recover sensitive security values using the fiql and orderby parameters.

4.9
CVSS
19.9%
EPSS (exploit prob.)
97th
EPSS percentile
2018-03-20
Published

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weaknesses

CWE-200

Affected products

VendorProductAffected versions
apachesyncope>= 1.2.0, < 1.2.11
apachesyncope>= 2.0.0, < 2.0.8
apachesyncope1.0.0
apachesyncope1.0.3
apachesyncope1.0.4
apachesyncope1.0.5
apachesyncope1.0.6
apachesyncope1.0.7
apachesyncope1.0.8
apachesyncope1.0.9
apachesyncope1.1.0
apachesyncope1.1.1
apachesyncope1.1.2
apachesyncope1.1.3
apachesyncope1.1.4
apachesyncope1.1.5
apachesyncope1.1.6
apachesyncope1.1.7
apachesyncope1.1.8

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2018-1322