Apache Syncope JEXL Context Builder Information Disclosure Vulnerability

A vulnerability allowing exposure of sensitive information through data queries has been identified in Apache Syncope versions 3.0 prior to 3.0.16, 4.0 prior to 4.0.5, and 4.1.0. This issue arises when an administrator with the appropriate entitlements for Derived Schemas creates a malicious JEXL expression. Such an expression can be exploited by any administrator with sufficient entitlements for User read access to retrieve security-sensitive information related to users.

Impact

Exploitation of this vulnerability could lead to unauthorized access to security-sensitive user information by administrators with the appropriate entitlements.

Remediation

Users are advised to upgrade to Apache Syncope versions 4.0.6 or 4.1.1, both of which address this vulnerability by imposing stricter controls on JEXL expression definitions.