Threats tagged 'ghsa-825g-mm5v-ggq4'

Apache Syncope Core versions prior to 3.0.14 and between 4.0.0-M0 and before 4.0.2 allow malicious administrators to inject Groovy code that can be executed remotely. This vulnerability arises from the feature that allows runtime reload of custom Groovy implementations, which was not properly sandboxed. The issue is fixed in versions 3.0.14 and 4.0.2 by enforcing sandboxing of Groovy code execution.