Skip to content

Commit d86c81b

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-73f3-rqqf-2j54 GHSA-v84m-gfw5-hm2w GHSA-73f3-rqqf-2j54 GHSA-v84m-gfw5-hm2w
1 parent 7c3c967 commit d86c81b

4 files changed

Lines changed: 168 additions & 80 deletions

File tree

‎advisories/github-reviewed/2026/02/GHSA-73f3-rqqf-2j54/GHSA-73f3-rqqf-2j54.json‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-73f3-rqqf-2j54",
4+
"modified": "2026-02-03T19:53:38Z",
5+
"published": "2026-02-03T18:30:44Z",
6+
"aliases": [
7+
"CVE-2026-23795"
8+
],
9+
"summary": "Apache Syncope: Console XXE on Keymaster parameters",
10+
"details": "Improper Restriction of XML External Entity Reference vulnerability in Apache Syncope Console. An administrator with adequate entitlements to create or edit Keymaster parameters via Console can construct malicious XML text to launch an XXE attack, thereby causing sensitive data leakage occurs.\n\nThis issue affects Apache Syncope: from 3.0 through 3.0.15, from 4.0 through 4.0.3.\n\nUsers are recommended to upgrade to version 3.0.16 / 4.0.4, which fix this issue.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "org.apache.syncope.client.idrepo:syncope-client-idrepo-console"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "3.0.0"
29+
},
30+
{
31+
"fixed": "3.0.16"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "Maven",
40+
"name": "org.apache.syncope.client.idrepo:syncope-client-idrepo-console"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "4.0.0"
48+
},
49+
{
50+
"fixed": "4.0.4"
51+
}
52+
]
53+
}
54+
]
55+
}
56+
],
57+
"references": [
58+
{
59+
"type": "ADVISORY",
60+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23795"
61+
},
62+
{
63+
"type": "PACKAGE",
64+
"url": "https://github.com/apache/syncope"
65+
},
66+
{
67+
"type": "WEB",
68+
"url": "https://lists.apache.org/thread/mzgbdn8hzk8vr94o660njcc7w62c2pos"
69+
},
70+
{
71+
"type": "WEB",
72+
"url": "http://www.openwall.com/lists/oss-security/2026/02/02/2"
73+
}
74+
],
75+
"database_specific": {
76+
"cwe_ids": [
77+
"CWE-611"
78+
],
79+
"severity": "MODERATE",
80+
"github_reviewed": true,
81+
"github_reviewed_at": "2026-02-03T19:53:38Z",
82+
"nvd_published_at": "2026-02-03T16:16:13Z"
83+
}
84+
}

‎advisories/github-reviewed/2026/02/GHSA-v84m-gfw5-hm2w/GHSA-v84m-gfw5-hm2w.json‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-v84m-gfw5-hm2w",
4+
"modified": "2026-02-03T19:54:38Z",
5+
"published": "2026-02-03T18:30:44Z",
6+
"aliases": [
7+
"CVE-2026-23794"
8+
],
9+
"summary": "Apache Syncope: Reflected XSS on Enduser Login",
10+
"details": "Reflected XSS in Apache Syncope's Enduser Login page.\n\nAn attacker that tricks a legitimate user into clicking a malicious link and logging in to Syncope Enduser could steal that user's credentials.\n\nThis issue affects Apache Syncope: from 3.0 through 3.0.15, from 4.0 through 4.0.3.\n\nUsers are recommended to upgrade to version 3.0.16 / 4.0.4, which fix this issue.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "org.apache.syncope.client.idrepo:syncope-client-idrepo-common-ui"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "3.0.0"
29+
},
30+
{
31+
"fixed": "3.0.16"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "Maven",
40+
"name": "org.apache.syncope.client.idrepo:syncope-client-idrepo-common-ui"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "4.0.0"
48+
},
49+
{
50+
"fixed": "4.0.4"
51+
}
52+
]
53+
}
54+
]
55+
}
56+
],
57+
"references": [
58+
{
59+
"type": "ADVISORY",
60+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23794"
61+
},
62+
{
63+
"type": "PACKAGE",
64+
"url": "https://github.com/apache/syncope"
65+
},
66+
{
67+
"type": "WEB",
68+
"url": "https://lists.apache.org/thread/7h30ghqdsf3spl3h7gdmscxofrm8ygjo"
69+
},
70+
{
71+
"type": "WEB",
72+
"url": "http://www.openwall.com/lists/oss-security/2026/02/02/1"
73+
}
74+
],
75+
"database_specific": {
76+
"cwe_ids": [
77+
"CWE-79"
78+
],
79+
"severity": "MODERATE",
80+
"github_reviewed": true,
81+
"github_reviewed_at": "2026-02-03T19:54:38Z",
82+
"nvd_published_at": "2026-02-03T16:16:13Z"
83+
}
84+
}

‎advisories/unreviewed/2026/02/GHSA-73f3-rqqf-2j54/GHSA-73f3-rqqf-2j54.json‎

Lines changed: 0 additions & 40 deletions
This file was deleted.

‎advisories/unreviewed/2026/02/GHSA-v84m-gfw5-hm2w/GHSA-v84m-gfw5-hm2w.json‎

Lines changed: 0 additions & 40 deletions
This file was deleted.

0 commit comments

Comments
 (0)