Vulnerability in Apache Syncope
CVE-2020-11977
In Apache Syncope 2.1.X releases prior to 2.1.7, when the Flowable extension is enabled, an administrator with workflow entitlements can use Shell Service Tasks to perform malicious operations, including but not limited to file read, file…
EPSS: 0.028 (85.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Apache Syncope
- N/a Apache Syncope — versions Apache Syncope 2.1.X releases prior to 2.1.7
References
- security@apache.org (x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2020-11977?
- CVE-2020-11977 is a high-severity vulnerability in Apache Syncope. CVSS score: 7.2/10. Published 2020-09-15.
- How severe is CVE-2020-11977?
- High severity. CVSS v3 base score is 7.2 out of 10.