CVE-2018-17186: Vulnerability in org.apache.syncope:syncope-core
Summary
CVE-2018-17186: Improper Restriction of XML External Entity Reference in org.apache.syncope:syncope-core. Affects org.apache.syncope:syncope-core across 2 version ranges.
< 2.0.11
>= 2.1.0, < 2.1.2
Fixed in 2.0.11 or 2.1.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The org.apache.syncope:syncope-core package is a Maven package that provides core functionality for the Apache Syncope project. It is responsible for managing workflow definitions and entitlements within the system.
Vulnerability Detail
This vulnerability allows an administrator with workflow definition entitlements to exploit a DTD vulnerability. By leveraging this vulnerability, an attacker can perform malicious operations such as file read, file write, and code execution. This can lead to unauthorized access, data leakage, and potential compromise of the entire system.
How To Fix
Latest published version: 4.1.3 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.0.112.0.11 -
>= 2.1.0, < 2.1.22.1.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to apply the recommended fix by upgrading to a secure version of the package.
Conclusion
This vulnerability in org.apache.syncope:syncope-core allows an attacker with workflow definition entitlements to perform malicious operations. It is crucial to upgrade to a secure version of the package to mitigate the risk of unauthorized access, data leakage, and system compromise. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.syncope:syncope-core →
FAQ
This vulnerability allows an attacker to perform unauthorized operations, potentially leading to data leakage, unauthorized access, and compromise of the system.
Users of org.apache.syncope:syncope-core versions prior to 2.0.11 and versions 2.1.0 to 2.1.2 are affected by this vulnerability.
No, there is no known workaround for this vulnerability. It is crucial to apply the recommended fix by upgrading to a secure version of the package.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities in software, using just the pom.xml file.
You can find more information about this vulnerability in the GitHub Advisory Database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/11/GHSA-qfjv-998w-q48f/GHSA-qfjv-998w-q48f.json
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.syncope:syncope-core.
