PT-2020-15194
CVE-2020-1961
·
تاريخ النشر
2020-05-04
·
تاريخ التحديث
2021-06-16
الوصف من
CVSS 3.1
9.8
حرجةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
Apache Syncope versions 2.0.0 through 2.0.14
Apache Syncope versions 2.1.0 through 2.1.5
Description
A Server-Side Template Injection vulnerability was discovered in the Mail templates of Apache Syncope, allowing attackers to inject arbitrary JEXL expressions. This leads to Remote Code Execution (RCE).
Recommendations
For Apache Syncope versions 2.0.0 through 2.0.14, update to version 2.0.15 or later.
For Apache Syncope versions 2.1.0 through 2.1.5, update to version 2.1.6 or later.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾