CyberRota Analysis
AI-GeneratedApache Syncope versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 are vulnerable to a code injection flaw that allows an authorized administrator to execute untrusted code by manipulating the CommandArgs static implementation. This could lead to unauthorized actions within the application, posing a risk to system integrity and data security. Administrators of affected versions should prioritize upgrading to versions 4.0.8 or 4.1.3 to mitigate this vulnerability.
Original NVD Description
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy Command class containing untrusted code in their CommandArgs static implementation, bypassing the Groovy security sandbox. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.