Threats tagged 'ghsa-pjhv-6xm9-9cxw'

A vulnerability in Apache Syncope allows an administrator with entitlements for Derived Schemas to create a malicious JEXL expression. This can enable any administrator with User read entitlements to access sensitive information from LinkedAccount or Manager objects, potentially including hashed credentials. The issue affects versions from 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. Upgrading to versions 4.0.8 or 4.1.3 addresses this vulnerability.