Apache Syncope: AuthProfile value escalation via self-service update

Summary

Improper Privilege Management vulnerability in Apache Syncope. AuthProfile self-updates allow non-admin users to configure impersonation for WA surrogate authentication. This issue affects Apache Syncope: from 3.0.12 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1.0-M0 through 4.1.3. Users are recommended to upgrade to version 4.0.9 / 4.1.4, which fix this issue.

Remediation

1. Inventory every Apache Software Foundation Apache Syncope deployment, including staging.
2. No fixed version appears in the public sources yet. Check the references below and the vendor directly.

References

• Advisoryhttps://lists.apache.org/thread.html/25vbq0pvj8svk8gl8pjld1j0nzrdxy26