CVSS 3.1
7.2 highCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HCVE-2020-11977
High (7.2) in apache syncope. EPSS 2.9% chance of exploitation in the next 30 days. Fixed in org.apache.syncope:syncope 2.1.7.
In Apache Syncope 2.1.X releases prior to 2.1.7, when the Flowable extension is enabled, an administrator with workflow entitlements can use Shell Service Tasks to perform malicious operations, including but not limited to file read, file write, and code execution.
Severity
- EPSS
- 2.9% chance of exploitation in the next 30 days; higher than 86% of CVEs (scores of 2026-10-31)
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:syncope
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-p2rp-cmjq-r7wm | Maven | org.apache.syncope:syncope | >=2.1.0 <2.1.7 | 2.1.7 |