CVE-2018-1322
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2018-1322
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Description
An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can recover sensitive security values using the fiql and orderby parameters.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Apache Syncope 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache Syncope是美国阿帕奇（Apache）软件基金会的一套用于企业环境中的开源数字身份管理系统。该系统支持身份管理、角色配置等。 Apache Syncope 1.2.11之前的1.2.x版本和2.0.8之前的2.0.x版本中存在安全漏洞。攻击者可借助‘fiql’和‘orderby’参数利用该漏洞恢复安全值。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Syncope | Releases prior to 1.2.11, Releases prior to 2.0.8 | - |
II. Public POCs for CVE-2018-1322
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2018-1322
请登录查看更多情报信息。
Same Patch Batch · Apache Software Foundation · 2018-03-20 · 3 CVEs total
| CVE-2018-1294 | Apache Commons-Email 输入验证错误漏洞 | |
| CVE-2018-1321 | Apache Syncope 安全漏洞 |
IV. Related Vulnerabilities
Same product: Apache Syncope
- CVE-2026-23794
Apache Syncope: Reflected XSS on Enduser Login - CVE-2026-23795
Apache Syncope: Console XXE on Keymaster parameters - CVE-2025-65998
Apache Syncope: Default AES key used for internal password e - CVE-2025-57738
Apache Syncope: Remote Code Execution by delegated administr - CVE-2024-45031
Apache Syncope: Stored XSS in Console and Enduser
Same vendor: Apache Software Foundation
- CVE-2026-39816
Apache NiFi: Missing Execute Code Required Permission on Tin - CVE-2026-25199
Apache CloudStack: Proxmox Extension Allows Unauthorized Cro - CVE-2026-25077
Apache CloudStack: Unauthenticated Command Injection in Dire - CVE-2025-69233
Apache CloudStack: Domain/account resources limits not honor - CVE-2025-66467
Apache CloudStack: MinIO policy remains intact on bucket del
V. Comments for CVE-2018-1322
No comments yet