GHSA-825g-mm5v-ggq4

    Dashboard / Vulnerabilities / GHSA-825g-mm5v-ggq4

    GHSA-825g-mm5v-ggq4

    Published: 20 Oct 2025Last Modified: 5 Nov 2025

    Summary: Apache Syncope allows malicious administrators to inject Groovy code

    Details: Apache Syncope offers the ability to extend / customize the base behavior on every deployment by allowing to provide custom implementations of a few Java interfaces; such implementations can be provided either as Java or Groovy classes, with the latter being particularly attractive as the machinery is set for runtime reload. Such a feature has been available for a while, but recently it was discovered that a malicious administrator can inject Groovy code that can be executed remotely by a running Apache Syncope Core instance. Users are recommended to upgrade to version 3.0.14 / 4.0.2, which fix this issue by forcing the Groovy code to run in a sandbox.

    References: https://nvd.nist.gov/vuln/detail/CVE-2025-57738, https://github.com/apache/syncope/commit/88c2b5b0be9e2ed66007d672e786165bc266e717, https://github.com/apache/syncope/commit/8b08c4d5785599a0e38830dcff89738b93f02a16, https://issues.apache.org/jira/browse/SYNCOPE-1907, https://lists.apache.org/thread/x7cv6xv7z76y49grdr1hgj1pzw5zbby6, https://syncope.apache.org/security#CVE-2025-57738, http://github.com/apache/syncope, http://www.openwall.com/lists/oss-security/2025/10/20/1

    Affected packages

    Package

    Name: org.apache.syncope.core:syncope-core-spring

    Purl: pkg:maven/org.apache.syncope.core/syncope-core-spring

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -3.0.14

    Affected versions

    2.0.0
    2.0.0-M2
    2.0.0-M3
    2.0.0-M4
    2.0.0.M5
    2.0.1
    2.0.10
    2.0.11
    2.0.12
    2.0.13
    2.0.14
    2.0.15
    2.0.16
    2.0.2
    2.0.3
    2.0.4
    2.0.5
    2.0.6
    2.0.7
    2.0.8
    2.0.9

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-825g-mm5v-ggq4 | CVE-DB