GitHub Advisoryadvisory · Maven

GHSA-p2rp-cmjq-r7wm Shell command injection in Apache Syncope

HIGH Published 2021-06-16 Modified 2021-05-04 Official page ↗
Aliases
CVE-2020-11977
Ecosystem
Maven
Packages
org.apache.syncope:syncope
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-78
Reviewed
2021-05-04

Affected packages

• Maven org.apache.syncope:syncope: >= 2.1.0, < 2.1.7 → fixed in 2.1.7

Description

In Apache Syncope 2.1.X releases prior to 2.1.7, when the Flowable extension is enabled, an administrator with workflow entitlements can use Shell Service Tasks to perform malicious operations, including but not limited to file read, file write, and code execution.

Related

Alias · CVE (1)

  • CVE-2020-11977 In Apache Syncope 2.1.X releases prior to 2.1.7, when the Flowable extension is enabled, an administrator with workflow entitlements can… vulnerability

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References