7.2

CVE-2025-57738: apache software foundation apache syncope

CVSS: 7.2v3.1HighModified
AliasesGHSA-825g-mm5v-ggq4
Published 20-10-2025Last modified 04-11-2025
Open JSON

Vulnerability summary

CVE-2025-57738 is a high (CVSS 7.2) vulnerability in apache software foundation apache syncope. EPSS estimates a 23.18% chance of exploitation in the next 30 days, higher than 97.7% of scored vulnerabilities.

Overall risk
33/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.2/10
010
High · v3.1 (CVE.org)
EPSS score
23.18%
0%100%
High · +0.08 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 20-10-2025
    PublishedVulnerability first disclosed.
  2. 04-11-2025
    Last modifiedVulnerability information updated.

Description

Apache Syncope offers the ability to extend / customize the base behavior on every deployment by allowing to provide custom implementations of a few Java interfaces; such implementations can be provided either as Java or Groovy classes, with the latter being particularly attractive as the machinery is set for runtime reload. Such a feature has been available for a while, but recently it was discovered that a malicious administrator can inject Groovy code that can be executed remotely by a running Apache Syncope Core instance. Users are recommended to upgrade to version 3.0.14 / 4.0.2, which fix this issue by forcing the Groovy code to run in a sandbox.

CVSS metrics

3 scores · 3 sources · 1 version

EPSS trend

Probability

23.18%

Chance of exploitation in the next 30 days

Percentile

98%

Versus all other CVEs

30-day change

+0.08 pp

From 23.11% on 18-09-2026

18-09-202618-10-2026
EPSS score
23.18%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Apache1 product
  • syncope≥ 2.1.0, < 3.0.14 | ≥ 4.0.0, < 4.0.2
Apache software foundation1 product
  • apache syncope≥ 2.1, ≤ 2.1.14 | ≥ 3.0, ≤ 3.0.13 | ≥ 4.0, ≤ 4.0.1
Org.apache.syncope.core1 product
  • syncope-core-spring< 3.0.14 | ≥ 4.0.0-M0, < 4.0.2

3 vendors · 3 products

References

8 links