CVE-2026-57308

Опубликовано: 20 июл. 2026

Источник: nvd

CVSS3: 9.8

EPSS Низкий

Описание

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Syncope.

An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized sort parameters.

This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1.

Users are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue.

Ссылки

https://lists.apache.org/thread/g0gpctj90pbczbjl5jr33t8gr1gltg8v
Mailing List
Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/07/20/8
Mailing List
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:apache:syncope:*:*:*:*:*:*:*:*

Версия от 3.0.0 (включая) до 3.0.16 (включая)

cpe:2.3:a:apache:syncope:*:*:*:*:*:*:*:*

Версия от 4.0.0 (включая) до 4.0.7 (исключая)

cpe:2.3:a:apache:syncope:*:*:*:*:*:*:*:*

Версия от 4.1.0 (включая) до 4.1.2 (исключая)

EPSS

Процентиль: 40%

0.00496

Низкий

9.8 Critical

CVSS3

Дефекты

CWE-89

Связанные уязвимости

GHSA-vqgw-p6qv-w77q

CVSS3: 9.8

github

около 2 месяцев назад

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized sort parameters. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1. Users are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue.

EPSS

Процентиль: 40%

0.00496

Низкий

9.8 Critical

CVSS3

Дефекты

CWE-89