Apache Syncope Console XML External Entity Vulnerability in Keymaster Parameters

A vulnerability allowing improper restriction of XML external entity references has been identified in the Apache Syncope Console, specifically in versions 3.0.0 to 3.0.15 and 4.0.0 to 4.0.3. This vulnerability allows an administrator with the right permissions to create or edit Keymaster parameters to craft malicious XML that can be used to launch an XML external entity (XXE) attack, leading to unauthorized access to sensitive data.

Impact

Exploitation of this vulnerability could result in an XXE attack, allowing for the manipulation of XML data processing and potentially leading to the disclosure of sensitive information.

Remediation

Users are advised to upgrade to Apache Syncope versions 3.0.16 or 4.0.4, which address this vulnerability.