CVE-2014-0111

Estado: ModificadaMedia (6.5)—

Apache Syncope 1.0.0 before 1.0.9 and 1.1.0 before 1.1.7 allows remote administrators to execute arbitrary Java code via vectors related to Apache Commons JEXL expressions, "derived schema definition," "user / role templates," and "account links of resource mappings."

CVSS

Versión: 2.0
Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P
Puntuación base: 6.5

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 3.31%
Percentil entre todas las CVEs puntuadas: 88
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Apache — Syncope

CWE

CWE-94

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2014-0111",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2014-04-17T14:55:06.763",
  "references": [
    {
      "url": "http://mail-archives.us.apache.org/mod_mbox/www-announce/201404.mbox/%3C534CE273.9020601%40apache.org%3E",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://syncope.apache.org/security.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/531841/100/0/threaded",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://mail-archives.us.apache.org/mod_mbox/www-announce/201404.mbox/%3C534CE273.9020601%40apache.org%3E",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://syncope.apache.org/security.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/531841/100/0/threaded",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Apache Syncope 1.0.0 before 1.0.9 and 1.1.0 before 1.1.7 allows remote administrators to execute arbitrary Java code via vectors related to Apache Commons JEXL expressions, \"derived schema definition,\" \"user / role templates,\" and \"account links of resource mappings.\""
    },
    {
      "lang": "es",
      "value": "Apache Syncope 1.0.0 anterior a 1.0.9 y 1.1.0 anterior a 1.1.7 permite a administradores remotos ejecutar código Java arbitrario a través de vectores relacionados con expresiones de Apache Commons JEXL, \"derived schema definition,\" \"user / role templates,\" y \"account links of resource mappings.\""
    }
  ],
  "lastModified": "2026-06-17T00:02:17.843",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:syncope:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2677A028-A10F-4019-8DFB-7A3C69F5954A",
              "versionEndExcluding": "1.0.9",
              "versionStartIncluding": "1.0.0"
            },
            {
              "criteria": "cpe:2.3:a:apache:syncope:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "08D57676-A061-4C12-B3D9-9E7B52F8AC9D",
              "versionEndExcluding": "1.1.7",
              "versionStartIncluding": "1.1.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}