CVE-2020-11977: High severity apache syncope vulnerability
Published Sep 15, 2020
·Updated
In Apache Syncope 2.1.X releases prior to 2.1.7, when the Flowable extension is enabled, an administrator with workflow entitlements can use Shell Service Tasks to perform malicious operations, including but not limited to file read, file write, and code execution.
Affected Software
1 affected component
Apache Syncope>=2.1.0<2.1.7
Event History
Sep 15, 2020
CVE Published
via MITRE·07:02 PM
Data Sourced
via MITRE·07:02 PM
DescriptionWeakness
Frequently Asked Questions
1
What is CVE-2020-11977?
CVE-2020-11977 is a vulnerability in Apache Syncope 2.1.X releases prior to 2.1.7.
2
What is the severity of CVE-2020-11977?
The severity of CVE-2020-11977 is high with a score of 7.2.
3
How does CVE-2020-11977 affect Apache Syncope?
CVE-2020-11977 affects Apache Syncope 2.1.X releases prior to 2.1.7 when the Flowable extension is enabled.
4
What can an attacker do with CVE-2020-11977?
An attacker with workflow entitlements can use Shell Service Tasks to perform malicious operations, including file read, file write, and code execution.
5
How can I fix CVE-2020-11977?
To fix CVE-2020-11977, upgrade Apache Syncope to version 2.1.7 or higher.