CVE-2018-1322
Estado: ModificadaMedia (4.9)—
An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can recover sensitive security values using the fiql and orderby parameters.
CVSS
- Versión: 3.0
- Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
- Puntuación base: 4.9
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 20%
- Percentil entre todas las CVEs puntuadas: 97
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
CWE
- CWE-200
Referencias
- http://syncope.apache.org/security.html#CVE-2018-1322:_Information_disclosure_via_FIQL_and_ORDER_BY_sorting
- http://www.securityfocus.com/bid/103507
- https://www.exploit-db.com/exploits/45400/
- http://syncope.apache.org/security.html#CVE-2018-1322:_Information_disclosure_via_FIQL_and_ORDER_BY_sorting
- http://www.securityfocus.com/bid/103507
- https://www.exploit-db.com/exploits/45400/
JSON original (NVD)
Mostrar
{
"id": "CVE-2018-1322",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 4,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
"authentication": "SINGLE",
"integrityImpact": "NONE",
"accessComplexity": "LOW",
"availabilityImpact": "NONE",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 8,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.0",
"baseScore": 4.9,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "HIGH",
"confidentialityImpact": "HIGH"
},
"impactScore": 3.6,
"exploitabilityScore": 1.2
}
]
},
"affected": [
{
"source": "security@apache.org",
"affectedData": [
{
"vendor": "Apache Software Foundation",
"product": "Apache Syncope",
"versions": [
{
"status": "affected",
"version": "Releases prior to 1.2.11, Releases prior to 2.0.8"
},
{
"status": "affected",
"version": "The unsupported Releases 1.0.x, 1.1.x may be also affected."
}
]
}
]
}
],
"published": "2018-03-20T17:29:00.300",
"references": [
{
"url": "http://syncope.apache.org/security.html#CVE-2018-1322:_Information_disclosure_via_FIQL_and_ORDER_BY_sorting",
"tags": [
"Mitigation",
"Vendor Advisory"
],
"source": "security@apache.org"
},
{
"url": "http://www.securityfocus.com/bid/103507",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "security@apache.org"
},
{
"url": "https://www.exploit-db.com/exploits/45400/",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "security@apache.org"
},
{
"url": "http://syncope.apache.org/security.html#CVE-2018-1322:_Information_disclosure_via_FIQL_and_ORDER_BY_sorting",
"tags": [
"Mitigation",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/bid/103507",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.exploit-db.com/exploits/45400/",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-200"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can recover sensitive security values using the fiql and orderby parameters."
},
{
"lang": "es",
"value": "Un administrador con privilegios de búsqueda de usuarios en Apache Syncope, en versiones 1.2.x anteriores a la 1.2.11, versiones 2.0.x anteriores a la 2.0.8 y versiones 1.0.x y 1.1.x no soportadas que también podrían verse afectadas, puede recuperar valores sensibles para la seguridad empleando los parámetros fiql y orderby."
}
],
"lastModified": "2026-06-17T01:51:01.147",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:apache:syncope:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C352FD95-915E-4382-8020-8D5F738D63A9",
"versionEndExcluding": "1.2.11",
"versionStartIncluding": "1.2.0"
},
{
"criteria": "cpe:2.3:a:apache:syncope:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0664E504-BA1D-40C9-A4B2-53DCF4BDDA1E",
"versionEndExcluding": "2.0.8",
"versionStartIncluding": "2.0.0"
},
{
"criteria": "cpe:2.3:a:apache:syncope:1.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5E4BEECD-5BE6-4ADE-AB9F-82631A582D27"
},
{
"criteria": "cpe:2.3:a:apache:syncope:1.0.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "682C36BC-D3E7-4203-9793-313CC72DA62D"
},
{
"criteria": "cpe:2.3:a:apache:syncope:1.0.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B34E99B4-4EAD-47D8-BDE4-235836F85E8E"
},
{
"criteria": "cpe:2.3:a:apache:syncope:1.0.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8C28DB5E-FDC8-4D6C-8652-62071084AFE1"
},
{
"criteria": "cpe:2.3:a:apache:syncope:1.0.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EE1F61F6-8D9B-4DD3-9212-42AE1F399A27"
},
{
"criteria": "cpe:2.3:a:apache:syncope:1.0.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C4B181F2-B240-47CA-B5DD-9C5906D8E3B1"
},
{
"criteria": "cpe:2.3:a:apache:syncope:1.0.8:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6F9EEDCA-AE77-42C0-A99A-F7DF126E7901"
},
{
"criteria": "cpe:2.3:a:apache:syncope:1.0.9:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BE2E485D-8AA7-45B1-B436-D0C2260EE182"
},
{
"criteria": "cpe:2.3:a:apache:syncope:1.1.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4A4CE370-0229-4408-A2B1-5677B6ACDB3F"
},
{
"criteria": "cpe:2.3:a:apache:syncope:1.1.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D3FAA0C0-9FB0-4F63-BA1F-6AF504E6FFFA"
},
{
"criteria": "cpe:2.3:a:apache:syncope:1.1.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "904FD046-B8DF-4842-9DEA-78D03AF0394E"
},
{
"criteria": "cpe:2.3:a:apache:syncope:1.1.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0DBE0A5E-0576-4D6E-B5F9-C122405EA691"
},
{
"criteria": "cpe:2.3:a:apache:syncope:1.1.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A68014D4-1B64-478C-BBC2-168DB2FBF124"
},
{
"criteria": "cpe:2.3:a:apache:syncope:1.1.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7B5E2D4B-9BDE-432C-8269-4AE65586D2F4"
},
{
"criteria": "cpe:2.3:a:apache:syncope:1.1.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "85F12537-6086-4F5C-A875-F9139A3B56B6"
},
{
"criteria": "cpe:2.3:a:apache:syncope:1.1.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DCE40770-AC7A-4E5F-B7A0-37E9BBE55811"
},
{
"criteria": "cpe:2.3:a:apache:syncope:1.1.8:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4BB19E5F-707F-4F2F-93FF-619784E02D40"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "security@apache.org"
}