Unscored severity · published Apr 17, 2014
CVE-2014-0111
Apache Syncope 1.0.0 before 1.0.9 and 1.1.0 before 1.1.7 allows remote administrators to execute arbitrary Java code via vectors related to Apache Commons JEXL expressions,…
–
CVSS
3.3%
EPSS
No
On KEV
Description
Apache Syncope 1.0.0 before 1.0.9 and 1.1.0 before 1.1.7 allows remote administrators to execute arbitrary Java code via vectors related to Apache Commons JEXL expressions, "derived schema definition," "user / role templates," and "account links of resource mappings."
Exploitation
Is it being used?
Exploit prediction (EPSS)3.3% · higher than 88% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SY
Syncope · Apache
1.0.0 before 1.0.9; 1.1.0 before 1.1.7 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-0111
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-0111
mail-archives.us.apache.org
http://mail-archives.us.apache.org/mod_mbox/www-announce/201404.mbox/%3C534CE273.9020601%40apache.org%3E
Vendor Advisory
http://syncope.apache.org/security.html
Third Party Advisory
http://www.securityfocus.com/archive/1/531841/100/0/threaded
More from Syncope
9.8
CVE-2026-62183
Apache Syncope: User self-service privilege escalation
9.8
CVE-2026-57308
Apache Syncope: SQL injection vulnerability in Audit Events search
9.8
CVE-2026-53421
Apache Syncope: Remote Code Execution via Scripted Connector
9.8
CVE-2026-53405
Apache Syncope: Remote Code Execution via Flowable BPMN Groovy ScriptTask
9.8
CVE-2026-63071
Apache Syncope: RCE via Groovy Sandbox bypass