Threats affecting pkg:maven/org.apache.syncope.ext.flowable/syncope-ext-flowable-bpmn

Apache Syncope versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.8, and 4.1.0 through 4.1.3 contain an improper isolation vulnerability. An administrator with sufficient privileges can import BPMN process definitions containing JUEL expressions via the REST API and start them. These expressions execute directly on the server without sandboxing, potentially leading to unsafe code execution. The issue is fixed in versions 4.0.9 and 4.1.4, which reject BPMN definitions with expression attributes.

Apache Syncope versions from 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, and 4.1.0-M0 through 4.1.1 contain an improper isolation vulnerability. An administrator with sufficient privileges can import BPMN process definitions containing Groovy scriptTasks via the REST API, which execute without sandboxing on the server. This allows arbitrary Groovy code execution with high impact on confidentiality, integrity, and availability. Versions 4.0.7 and 4.1.2 address this issue by sandboxing Groovy scriptTasks.