GHSA-vjqw-r3ww-wj2w

Source

https://github.com/advisories/GHSA-vjqw-r3ww-wj2w

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/06/GHSA-vjqw-r3ww-wj2w/GHSA-vjqw-r3ww-wj2w.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-vjqw-r3ww-wj2w

Aliases

CVE-2020-1959

Published

2021-06-16T17:18:58Z

Modified

2023-11-08T04:02:47.307604Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Expression Language Injection in Apache Syncope

Details

A Server-Side Template Injection was identified in Apache Syncope prior to 2.1.6 enabling attackers to inject arbitrary Java EL expressions, leading to an unauthenticated Remote Code Execution (RCE) vulnerability. Apache Syncope uses Java Bean Validation (JSR 380) custom constraint validators. When building custom constraint violation error messages, they support different types of interpolation, including Java EL expressions. Therefore, if an attacker can inject arbitrary data in the error message template being passed, they will be able to run arbitrary Java code.

Database specific

{
    "nvd_published_at": "2020-05-04T13:15:00Z",
    "github_reviewed_at": "2021-05-25T20:59:03Z",
    "severity": "CRITICAL",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-917"
    ]
}

References

Affected packages

Maven / org.apache.syncope:syncope-core

Package

Name: org.apache.syncope:syncope-core; View open source insights on deps.dev
Purl: pkg:maven/org.apache.syncope/syncope-core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.1.6

Affected versions

1.*

1.0.0-RC1-incubating

1.0.0-RC2-incubating

1.0.0-RC3-incubating

1.0.0-incubating

1.0.1-incubating

1.0.2-incubating

1.0.3-incubating

1.0.4

1.0.5

1.0.6

1.0.7

1.0.8

1.0.9

1.1.0

1.1.1

1.1.2

1.1.3

1.1.4

1.1.5

1.1.6

1.1.7

1.1.8

1.2.0-M1

1.2.0

1.2.1

1.2.2

1.2.3

1.2.4

1.2.5

1.2.6

1.2.7

1.2.8

1.2.9

1.2.10

1.2.11

2.*

2.0.0-M1

2.0.0-M2

2.0.0-M3

2.0.0-M4

2.0.0.M5

2.0.0

2.0.1

2.0.2

2.0.3

2.0.4

2.0.5

2.0.6

2.0.7

2.0.8

2.0.9

2.0.10

2.0.11

2.0.12

2.0.13

2.0.14

2.0.15

2.0.16

2.1.0

2.1.1

2.1.2

2.1.3

2.1.4

2.1.5