CRITICAL🇵🇱 Wersja polska

CVE-2020-1961

CVSS 9.8v3.1pub. 2020-05-04upd. 2024-11-21

Vulnerability to Server-Side Template Injection on Mail templates for Apache Syncope 2.0.X releases prior to 2.0.15, 2.1.X releases prior to 2.1.6, enabling attackers to inject arbitrary JEXL expressions, leading to Remote Code Execution (RCE) was discovered.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Apache Syncope

    APP
    Apache
    2.0.0 – 2.0.15 (excl.)2.1.0 – 2.1.6 (excl.)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCE
CWE
References

Related vulnerabilities

CVE-2026-62183CRITICAL9.8PL ✓same product

Apache Syncope — privilege escalation do poziomu administratora przez REST API

CVE-2026-53405CRITICAL9.8PL ✓same product

Apache Syncope: Wykonanie kodu Groovy bez sandbox przez BPMN REST API

CVE-2026-57308CRITICAL9.8PL ✓same product

SQL Injection w Apache Syncope via niesanityzowane parametry sortowania

CVE-2026-53421CRITICAL9.8PL ✓same product

Apache Syncope — RCE przez niebezpieczne wykonywanie skryptów Groovy

CVE-2026-63071CRITICAL9.8PL ✓same product

Apache Syncope – ominięcie sandboxa Groovy przez administratora