by Kastro
Paper/Archive/CVE-2020-1961

CVE-2020-1961

apache — Vulnerability to Server-Side Template Injection on Mail templates for Apache Syncope 2.0.X releases prior to 2.0.15, 2.1.X releases prior…

EPSS 5%CVSS 9.8
critical.is priorityof 100
48
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 91.9.919 × 2018.4No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Vulnerability to Server-Side Template Injection on Mail templates for Apache Syncope 2.0.X releases prior to 2.0.15, 2.1.X releases prior to 2.1.6, enabling attackers to inject arbitrary JEXL expressions, leading to Remote Code Execution (RCE) was discovered.

Affected

ProductAffectedFixed inSource
Apache SyncopeApache Syncope 2.0.X releases prior to 2.0.15, 2.1.X releases prior to 2.1.6–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refsyncope.apache.org/security