CVE-2025-57738

Apache Syncope offers the ability to extend / customize the base behavior on every deployment by allowing to provide custom implementations of a few Java interfaces; such implementations can be provided either as Java or Groovy classes, with the latter being particularly attractive as the machinery is set for runtime reload. Such a feature has been available for a while, but recently it was discovered that a malicious administrator can inject Groovy code that can be executed remotely by a running Apache Syncope Core instance. Users are recommended to upgrade to version 3.0.14 / 4.0.2, which fix this issue by forcing the Groovy code to run in a sandbox.

CVSS v3 7.2 HIGH

7.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread/x7cv6xv7z76y49grdr1hgj1pzw5zbby6	Mailing List Release Notes
http://www.openwall.com/lists/oss-security/2025/10/20/1

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:apache:syncope::::::::
	cpe:2.3:a:apache:syncope::::::::

History

08 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Apache Syncope ofrece la capacidad de extender / personalizar el comportamiento base en cada despliegue al permitir proporcionar implementaciones personalizadas de unas pocas interfaces Java; dichas implementaciones pueden proporcionarse como clases Java o Groovy, siendo estas últimas particularmente atractivas ya que la maquinaria está configurada para la recarga en tiempo de ejecución. Dicha característica ha estado disponible durante un tiempo, pero recientemente se descubrió que un administrador malicioso puede inyectar código Groovy que puede ser ejecutado remotamente por una instancia de Apache Syncope Core en ejecución. Se recomienda a los usuarios actualizar a la versión 3.0.14 / 4.0.2, que corrige este problema al forzar que el código Groovy se ejecute en una sandbox.

Information

Published : 2025-10-20 15:15

Updated : 2026-10-08 22:10

NVD link : CVE-2025-57738

Mitre link : CVE-2025-57738

CVE.ORG link : CVE-2025-57738

JSON object : View

Products Affected

apache

syncope

CWE

CWE-653

Improper Isolation or Compartmentalization

{"id": "CVE-2025-57738", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-57738", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-10-20T15:13:38.012543Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache Syncope", "versions": [{"status": "affected", "version": "2.1", "versionType": "semver", "lessThanOrEqual": "2.1.14"}, {"status": "affected", "version": "3.0", "versionType": "semver", "lessThanOrEqual": "3.0.13"}, {"status": "affected", "version": "4.0", "versionType": "semver", "lessThanOrEqual": "4.0.1"}], "defaultStatus": "unaffected"}]}], "published": "2025-10-20T15:15:33.553", "references": [{"url": "https://lists.apache.org/thread/x7cv6xv7z76y49grdr1hgj1pzw5zbby6", "tags": ["Mailing List", "Release Notes"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2025/10/20/1", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-653"}]}], "descriptions": [{"lang": "en", "value": "Apache Syncope offers the ability to extend / customize the base behavior on every deployment by allowing to provide custom implementations of a few Java interfaces; such implementations can be provided either as Java or Groovy classes, with the latter being particularly attractive as the machinery is set for runtime reload.\nSuch a feature has been available for a while, but recently it was discovered that a malicious administrator can inject Groovy code that can be executed remotely by a running Apache Syncope Core instance.\nUsers are recommended to upgrade to version 3.0.14 / 4.0.2, which fix this issue by forcing the Groovy code to run in a sandbox."}, {"lang": "es", "value": "Apache Syncope ofrece la capacidad de extender / personalizar el comportamiento base en cada despliegue al permitir proporcionar implementaciones personalizadas de unas pocas interfaces Java; dichas implementaciones pueden proporcionarse como clases Java o Groovy, siendo estas \u00faltimas particularmente atractivas ya que la maquinaria est\u00e1 configurada para la recarga en tiempo de ejecuci\u00f3n. Dicha caracter\u00edstica ha estado disponible durante un tiempo, pero recientemente se descubri\u00f3 que un administrador malicioso puede inyectar c\u00f3digo Groovy que puede ser ejecutado remotamente por una instancia de Apache Syncope Core en ejecuci\u00f3n. Se recomienda a los usuarios actualizar a la versi\u00f3n 3.0.14 / 4.0.2, que corrige este problema al forzar que el c\u00f3digo Groovy se ejecute en una sandbox."}], "lastModified": "2026-10-08T22:10:00.563", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:syncope:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8823A707-C1A3-4418-8DC2-CB879C8D2D8A", "versionEndExcluding": "3.0.14", "versionStartIncluding": "2.1.0"}, {"criteria": "cpe:2.3:a:apache:syncope:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8722F657-C2A5-49FE-B79D-2B06F030A8AF", "versionEndExcluding": "4.0.2", "versionStartIncluding": "4.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}