GitHub Advisoryadvisory · Maven

GHSA-4w4p-xwrr-9crh Injection in Apache Syncope

HIGH Published 2021-06-16 Modified 2021-05-25 Official page ↗
Aliases
CVE-2020-1961
Ecosystem
Maven
Packages
org.apache.syncope:syncope-core
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-74
Reviewed
2021-05-25

Affected packages

• Maven org.apache.syncope:syncope-core: >= 2.0.0, < 2.0.15 → fixed in 2.0.15 • Maven org.apache.syncope:syncope-core: >= 2.1.0, < 2.1.6 → fixed in 2.1.6

Description

Vulnerability to Server-Side Template Injection on Mail templates for Apache Syncope 2.0.X releases prior to 2.0.15, 2.1.X releases prior to 2.1.6, enabling attackers to inject arbitrary JEXL expressions, leading to Remote Code Execution (RCE) was discovered.

Related

Alias · CVE (1)

  • CVE-2020-1961 Vulnerability to Server-Side Template Injection on Mail templates for Apache Syncope 2.0.X releases prior to 2.0.15, 2.1.X releases prior… vulnerability

Weakness · CWE (1)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References