Apache Syncope: Delegated administration boundaries can be bypassed for Realm update

Summary

Authorization bypass through User-Controlled key vulnerability in Apache Syncope. A delegated administrator can relocate a Realm subtree across administrative realm boundaries without permission for the destination This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1.0-M0 through 4.1.3. Users are recommended to upgrade to version 4.0.9 / 4.1.4, which fix this issue.

Remediation

1. Inventory every Apache Software Foundation Apache Syncope deployment, including staging.
2. No fixed version appears in the public sources yet. Check the references below and the vendor directly.

References

• Advisoryhttps://lists.apache.org/thread.html/gn7y6k37xgody4wt4o981cywcovgw106