Description

Vulnerability to Server-Side Template Injection on Mail templates for Apache Syncope 2.0.X releases prior to 2.0.15, 2.1.X releases prior to 2.1.6, enabling attackers to inject arbitrary JEXL expressions, leading to Remote Code Execution (RCE) was discovered.

Remediation

References

http://syncope.apache.org/security

Related Vulnerabilities

CVE-2015-1926 Vulnerability in maven package org.apache.portals.pluto:portletv3annotateddemo

CVE-2020-2123 Vulnerability in maven package org.jenkins-ci.plugins:radargun

CVE-2020-26882 Vulnerability in maven package com.typesafe.play:play

CVE-2022-28220 Vulnerability in maven package org.apache.james.protocols:protocols-netty

CVE-2023-46115 Vulnerability in npm package @tauri-apps/cli

Severity

Critical

Classification

CWE-74 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Vendor Advisory