Description
An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can recover sensitive security values using the fiql and orderby parameters.
Remediation
References
http://syncope.apache.org/security.html#CVE-2018-1322:_Information_disclosure_via_FIQL_and_ORDER_BY_sorting
http://www.securityfocus.com/bid/103507
https://www.exploit-db.com/exploits/45400/
Related Vulnerabilities
CVE-2022-25206 Vulnerability in maven package org.jenkins-ci.plugins:dbcharts
CVE-2022-24762 Vulnerability in npm package sysend
CVE-2019-10347 Vulnerability in maven package javagh.jenkins:mashup-portlets-plugin
CVE-2014-3612 Vulnerability in maven package org.apache.activemq:activemq-broker
CVE-2022-1243 Vulnerability in maven package org.webjars.npm:urijs