CVE-2025-57738
Description
Apache Syncope offers the ability to extend / customize the base behavior on every deployment by allowing to provide custom implementations of a few Java interfaces; such implementations can be provided either as Java or Groovy classes, with the latter being particularly attractive as the machinery is set for runtime reload. Such a feature has been available for a while, but recently it was discovered that a malicious administrator can inject Groovy code that can be executed remotely by a running Apache Syncope Core instance. Users are recommended to upgrade to version 3.0.14 / 4.0.2, which fix this issue by forcing the Groovy code to run in a sandbox.
How to fix
- apache syncope3.0.14, 4.0.2 or later
- org.apache.syncope.core:syncope-core-spring3.0.14, 4.0.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache syncope | 2.1.0 ≤ v < 3.0.14, 4.0.0 ≤ v < 4.0.2 | 3.0.14, 4.0.2 |
| org.apache.syncope.core:syncope-core-springMaven | v < 3.0.14, 4.0.0-M0 ≤ v < 4.0.2 | 3.0.14, 4.0.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.