Vulnerability Description
Apache Syncope offers the ability to extend / customize the base behavior on every deployment by allowing to provide custom implementations of a few Java interfaces; such implementations can be provided either as Java or Groovy classes, with the latter being particularly attractive as the machinery is set for runtime reload. Such a feature has been available for a while, but recently it was discovered that a malicious administrator can inject Groovy code that can be executed remotely by a running Apache Syncope Core instance. Users are recommended to upgrade to version 3.0.14 / 4.0.2, which fix this issue by forcing the Groovy code to run in a sandbox.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Syncope | >= 2.1.0, < 3.0.14 |
Related Weaknesses (CWE)
References
- https://lists.apache.org/thread/x7cv6xv7z76y49grdr1hgj1pzw5zbby6Mailing ListRelease Notes
- http://www.openwall.com/lists/oss-security/2025/10/20/1
FAQ
What is CVE-2025-57738?
CVE-2025-57738 is a vulnerability with a CVSS score of 7.2 (HIGH). Apache Syncope offers the ability to extend / customize the base behavior on every deployment by allowing to provide custom implementations of a few Java interfaces; such implementations can be provid...
How severe is CVE-2025-57738?
CVE-2025-57738 has been rated HIGH with a CVSS base score of 7.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-57738?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Syncope.