CVE-2025-57738

Published Oct 20, 2025

Last updated 8 months ago

Apache Syncope

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-57738 describes a vulnerability within Apache Syncope, an open-source identity management system. This flaw allows a malicious administrator to inject Groovy code, which can then be executed remotely by a running Apache Syncope Core instance. The issue stems from the ability to provide custom implementations of Java interfaces using Groovy classes, a feature designed for extending and customizing the system's behavior. To address this vulnerability, users are advised to upgrade to Apache Syncope version 3.0.14 or 4.0.2. These updated versions mitigate the risk by enforcing a sandbox environment for the Groovy code, thereby preventing unauthorized remote execution.

Description: Apache Syncope offers the ability to extend / customize the base behavior on every deployment by allowing to provide custom implementations of a few Java interfaces; such implementations can be provided either as Java or Groovy classes, with the latter being particularly attractive as the machinery is set for runtime reload. Such a feature has been available for a while, but recently it was discovered that a malicious administrator can inject Groovy code that can be executed remotely by a running Apache Syncope Core instance. Users are recommended to upgrade to version 3.0.14 / 4.0.2, which fix this issue by forcing the Groovy code to run in a sandbox.
Source: security@apache.org
NVD status: Analyzed
Products: syncope

Risk scores

CVSS 3.1

Type: Secondary
Base score: 7.2
Impact score: 5.9
Exploitability score: 1.2
Vector string: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

security@apache.org: CWE-653

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:apache:syncope:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "8823A707-C1A3-4418-8DC2-CB879C8D2D8A",
            "versionEndExcluding": "3.0.14",
            "versionStartIncluding": "2.1.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:apache:syncope:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "8722F657-C2A5-49FE-B79D-2B06F030A8AF",
            "versionEndExcluding": "4.0.2",
            "versionStartIncluding": "4.0.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.