CVE-2020-11977
HIGHApache Syncope 2.1.0-2.1.6 - Authenticated Remote Code Execution via Flowable Shell Service Task
Title source: llmDescription
In Apache Syncope 2.1.X releases prior to 2.1.7, when the Flowable extension is enabled, an administrator with workflow entitlements can use Shell Service Tasks to perform malicious operations, including but not limited to file read, file write, and code execution.
References (1)
Core 1
Core References
Vendor Advisory x_refsource_misc
https://syncope.apache.org/security#CVE-2020-11977:_Remote_Code_Execution_via_Flowable_workflow_definition
Scores
CVSS v3
7.2
EPSS
0.0059
EPSS Percentile
69.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Details
Status
published
Products (2)
apache/syncope
2.1.0 - 2.1.7
org.apache.syncope/syncope
2.1.0 - 2.1.7Maven
Published
Sep 15, 2020
Tracked Since
Feb 18, 2026