Apache Syncope allows malicious administrators to inject Groovy code
Apache Syncope offers the ability to extend / customize the base behavior on every deployment by allowing to provide custom implementations of a few Java interfaces; such implementations can be provided either as Java or Groovy classes, with the latter being particularly attractive as the machinery is set for runtime reload. Such a feature has been available for a while, but recently it was discovered that a malicious administrator can inject Groovy code that can be executed remotely by a running Apache Syncope Core instance. Users are recommended to upgrade to version 3.0.14 / 4.0.2, which fix this issue by forcing the Groovy code to run in a sandbox.
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Java / Kotlin (Maven) | org.apache.syncope.core:syncope-core-spring | < 3.0.14, >= 4.0.0-M0, < 4.0.2 | 3.0.14, 4.0.2 |
Referencias
- https://nvd.nist.gov/vuln/detail/CVE-2025-57738
- https://github.com/apache/syncope/commit/88c2b5b0be9e2ed66007d672e786165bc266e717
- https://github.com/apache/syncope/commit/8b08c4d5785599a0e38830dcff89738b93f02a16
- https://issues.apache.org/jira/browse/SYNCOPE-1907
- https://lists.apache.org/thread/x7cv6xv7z76y49grdr1hgj1pzw5zbby6
- https://syncope.apache.org/security#CVE-2025-57738
- http://github.com/apache/syncope
- http://www.openwall.com/lists/oss-security/2025/10/20/1
- Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H- Debilidad (CWE)
CWE-653- Plataforma
- Java / Kotlin (Maven)
- Paquete
org.apache.syncope.core:syncope-core-spring- Publicada
- 20.10.2025
- Actualizado
- 11.10.2026 12:22
Fuentes y licencias
OSV / GitHub Advisory Database - GHSA-825g-mm5v-ggq4 - CC BY 4.0
Historial de vulnerabilidades: org.apache.syncope.core:syncope-core-spring
Todas las vulnerabilidades publicadas de este paquete (Java / Kotlin (Maven)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 2
- Primera → última
- 10.2025 05.2026
- Sin corrección
- 0
- Explotada en ataques
- 0
Distribución por gravedad
- Alta 2
Divulgaciones por año
- 2025: 1
- 2026: 1
-
Apache Syncope allows malicious administrators to inject Groovy code esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.