CVE-2018-1321: Apache Syncope XSLT Transformation Vulnerability
Summary
CVE-2018-1321: High severity vulnerability that affects org.apache.syncope:syncope-core. Affects org.apache.syncope:syncope-core across 2 version ranges.
< 1.2.11
>= 2.0.0, < 2.0.8
Fixed in 1.2.11 or 2.0.8, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Syncope is an open-source system for managing digital identities in enterprise environments. It provides functionalities such as user provisioning, workflow management, and role-based access control. The 'syncope-core' package is a key component of Apache Syncope, responsible for core functionality and data processing. This package is vulnerable to an XSLT transformation vulnerability.
Vulnerability Detail
The XSLT transformation vulnerability in Apache Syncope allows an administrator with report and template entitlements to perform malicious operations. This includes unauthorized file read, file write, and code execution. The vulnerability exists in versions 1.2.x before 1.2.11 and 2.0.x before 2.0.8 of the 'syncope-core' package.
How To Fix
Latest published version: 4.1.3 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.2.111.2.11 -
>= 2.0.0, < 2.0.82.0.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading the Apache Syncope package to the latest patched version.
Conclusion
The XSLT transformation vulnerability in Apache Syncope poses a high risk to the security of the system. It is crucial to upgrade the 'syncope-core' package to the latest patched version to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.syncope:syncope-core →
FAQ
Apache Syncope is an open-source system for managing digital identities in enterprise environments. It provides functionalities such as user provisioning, workflow management, and role-based access control.
The 'syncope-core' package is a key component of Apache Syncope, responsible for core functionality and data processing.
An XSLT transformation vulnerability allows an attacker to exploit XSL Transformations to perform malicious operations, such as unauthorized file read, file write, and code execution.
Versions 1.2.x before 1.2.11 and 2.0.x before 2.0.8 of the 'syncope-core' package are affected by this vulnerability.
To fix this vulnerability, upgrade the Apache Syncope package to version 1.2.11 or later for 1.2.x versions, and version 2.0.8 or later for 2.0.x versions.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.syncope:syncope-core.
