CVE-2020-1959
Last modified
CVE-2020-1959 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. A Server-Side Template Injection was identified in Apache Syncope prior to 2.1.6 enabling attackers to inject arbitrary Java EL expressions, leading to an unauthenticated Remote Code Execution (RCE) vulnerability. Apache Syncope uses Java Bean Validation (JSR 380) custom constraint validators. EPSS estimates a 4.82% chance of exploitation in the next 30 days.
Description
A Server-Side Template Injection was identified in Apache Syncope prior to 2.1.6 enabling attackers to inject arbitrary Java EL expressions, leading to an unauthenticated Remote Code Execution (RCE) vulnerability. Apache Syncope uses Java Bean Validation (JSR 380) custom constraint validators. When building custom constraint violation error messages, they support different types of interpolation, including Java EL expressions. Therefore, if an attacker can inject arbitrary data in the error message template being passed, they will be able to run arbitrary Java code.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Apache | Syncope | >= 2.1.0, < 2.1.6 |
References
- http://syncope.apache.org/securityVendor Advisory
- http://syncope.apache.org/securityVendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-1959?
How severe is CVE-2020-1959?
How do I fix CVE-2020-1959?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-19559An issue in Diebold Aglis XFS for Opteva v.4.1.61.1 allows a…9.8
- CVE-2020-1956Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has s…8.8
- CVE-2020-1957Apache Shiro before 1.5.2, when using Apache Shiro with Spri…9.8
- CVE-2020-1958When LDAP authentication is enabled in Apache Druid 0.17.0, …6.5
- CVE-2020-19586Incorrect Access Control issue in Yellowfin Business Intelli…9
- CVE-2020-19587Cross Site Scripting (XSS) vulnerability in configMap parame…5.4
- CVE-2020-19595Buffer overflow vulnerability in Core FTP Server v2 Build 69…7.5
- CVE-2020-19596Buffer overflow vulnerability in Core FTP Server v1.2 Build …9.8
- CVE-2020-1960A vulnerability in Apache Flink (1.1.0 to 1.1.5, 1.2.0 to 1.…4.7
- CVE-2020-19609Artifex MuPDF before 1.18.0 has a heap based buffer over-wri…5.5
- CVE-2020-1961Vulnerability to Server-Side Template Injection on Mail temp…9.8
- CVE-2020-19611Cross Site Scripting (XSS) in redirect module of Racktables …6.1
Are you affected by CVE-2020-1959?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST