CVE-2025-65998

HIGH EPSS 35.8%
Published Nov 24, 20257mo ago · Modified Jun 17, 20262w ago
7.5 CVSS 3.1
High
Find Similar
Published Nov 24, 2025 7mo ago
Last Modified Jun 17, 2026 2w ago

Description

Apache Syncope can be configured to store the user password values in the internal database with AES encryption, though this is not the default option. When AES is configured, the default key value, hard-coded in the source code, is always used. This allows a malicious attacker, once obtained access to the internal database content, to reconstruct the original cleartext password values. This is not affecting encrypted plain attributes, whose values are also stored using AES encryption. Users are recommended to upgrade to version 3.0.15 / 4.0.3, which fix this issue.

CVSS Details

Base Score
7.5
Exploitability
3.9
Impact
3.6
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity None
Availability None

Threat Intelligence

EPSS Exploit Probability
35.8% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 1

CWE-321

Affected Products 3

VendorProductVersionRange
apachesyncope*≥2.1.0  –  ≤2.1.14
apachesyncope*≥3.0.0  –  <3.0.15
apachesyncope*≥4.0.0  –  <4.0.3

References 2

  • openwall.com http://www.openwall.com/lists/oss-security/2025/11/24/1
    Mailing ListThird Party Advisory
  • lists.apache.org https://lists.apache.org/thread/fjh0tb0d1xkbphc5ogdsc348ppz88cts
    Mailing ListVendor Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.