org.apache.syncope.core.idm:syncope-core-idm-logic@4.1.0
latest version
4.1.3
latest non vulnerable version
first published
4 years ago
latest version published
24 days ago
licenses detected
- [3.0.0-M0,)
package registry
Direct Vulnerabilities
Known vulnerabilities in the org.apache.syncope.core.idm:syncope-core-idm-logic package. This does not include vulnerabilities belonging to this package’s dependencies.
Fix vulnerabilities automatically
Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.
Fix for free| Vulnerability | Vulnerable Version |
|---|---|
Affected versions of this package are vulnerable to Incorrect Authorization due to incomplete security checks in the reconciliation service's pull and push processes. An attacker can gain unauthorized access to restricted resources by making calls as an administrator without the necessary entitlements. How to fix Incorrect Authorization? Upgrade | [3.0.0-M0,4.0.8)[4.1.0-M0,4.1.3) |
Affected versions of this package are vulnerable to Incorrect Authorization via the REST API. An attacker can access confidential configuration values from other realms by leveraging administrative entitlements in one realm to read connector configurations scoped to another realm. How to fix Incorrect Authorization? Upgrade | [3.0.0-M0,4.0.8)[4.1.0-M0,4.1.3) |
Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) in the How to fix Server-side Request Forgery (SSRF)? Upgrade | [3.0.0-M0,4.0.7)[4.1.0-M0,4.1.2) |