PT-2020-12964 · Apache · Apache Syncope

Published 2020-09-15 · Updated 2021-06-16 · CVE-2020-11977

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Syncope versions prior to 2.1.7

Description The issue allows an administrator with workflow entitlements to perform malicious operations when the Flowable extension is enabled. This can include file read, file write, and code execution using Shell Service Tasks.

Recommendations For versions prior to 2.1.7, update to version 2.1.7 or later to resolve the issue. As a temporary workaround, consider disabling the Flowable extension until a patch is available. Restrict access to Shell Service Tasks to minimize the risk of exploitation.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2020-11977

GHSA-P2RP-CMJQ-R7WM

Affected Products

Apache Syncope

References · 4

• https://syncope.apache.org/security#CVE-2020-11977:_Remote_Code_Execution_via_Flowable_workflow_definition · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-11977 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-11977 · Security Note
• https://osv.dev/vulnerability/GHSA-p2rp-cmjq-r7wm · Vendor Advisory