Medium
Security advisory
An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can recover sensitive security values using the fiql and orderby parameters.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2018-1322
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 07:34 UTC · Revision 1
Source evidence
An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can recover sensitive security values using the fiql and orderby parameters.
osv:CVE-2018-1322
Complete source record
{
"id": "26bd1f91276835aeb686a626eb6b835f8e0f7aee1b2eac36cc1dbb71641c660e",
"url": "https://osv.dev/vulnerability/CVE-2018-1322",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2018-1322",
"summary": "An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can recover sensitive security values using the fiql and orderby parameters.",
"evidence": "osv:CVE-2018-1322",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2018-1322",
"aliases": [
"CVE-2018-1322",
"GHSA-v3vf-2r98-xw8w"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/apache/syncope",
"type": "GIT",
"events": [
{
"introduced": "c4c9de1b34920110f6c0e4feaf62e1d197ec872b"
},
{
"fixed": "1583964bffaf14ec90641a11523bb75aef8097e3"
},
{
"introduced": "973afc777d2f8093785875c62e808d97334fb2e3"
},
{
"fixed": "7a012b5de2f91fc056eb8a8a14c720ea91bfaf58"
},
{
"introduced": "f198eed905720cce150cafb4e2a874deee8dc016"
},
{
"last_affected": "2836c57936c1c166a2aa14c8842f7a5832b82695"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:apache:syncope:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.2.0"
},
{
"fixed": "1.2.11"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:apache:syncope:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.0.8"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:apache:syncope:1.0.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.0.0"
},
{
"last_affected": "1.0.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:syncope:1.0.3:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.0.3"
},
{
"last_affected": "1.0.3"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:syncope:1.0.4:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.0.4"
},
{
"last_affected": "1.0.4"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:syncope:1.0.5:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.0.5"
},
{
"last_affected": "1.0.5"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:syncope:1.0.6:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.0.6"
},
{
"last_affected": "1.0.6"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:syncope:1.0.7:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.0.7"
},
{
"last_affected": "1.0.7"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:syncope:1.0.8:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.0.8"
},
{
"last_affected": "1.0.8"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:syncope:1.0.9:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.0.9"
},
{
"last_affected": "1.0.9"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:syncope:1.1.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.1.0"
},
{
"last_affected": "1.1.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:syncope:1.1.1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.1.1"
},
{
"last_affected": "1.1.1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:syncope:1.1.2:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.1.2"
},
{
"last_affected": "1.1.2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:syncope:1.1.3:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.1.3"
},
{
"last_affected": "1.1.3"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:syncope:1.1.4:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.1.4"
},
{
"last_affected": "1.1.4"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:syncope:1.1.5:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.1.5"
},
{
"last_affected": "1.1.5"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:syncope:1.1.6:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.1.6"
},
{
"last_affected": "1.1.6"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:syncope:1.1.7:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.1.7"
},
{
"last_affected": "1.1.7"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:syncope:1.1.8:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.1.8"
},
{
"last_affected": "1.1.8"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"1.0.0",
"1.0.3",
"1.0.4",
"1.0.5",
"1.0.6",
"1.0.7",
"1.0.8",
"1.0.9",
"1.1.0",
"1.1.1",
"1.1.2",
"1.1.3",
"1.1.4",
"1.1.5",
"1.1.6",
"1.1.7",
"1.1.8",
"syncope-2.0.7",
"syncope-2.0.6",
"syncope-2.0.5",
"syncope-2.0.4",
"syncope-2.0.3",
"syncope-2.0.2",
"syncope-2.0.1",
"syncope-2.0.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-1322.json"
}
}
],
"modified": "2026-10-24T10:30:54.973169325Z",
"provider": "osv",
"references": [
"https://www.exploit-db.com/exploits/45400/"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2018-1322",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 438323,
"published_at": "2018-03-20T17:29:00.3+00:00"
}