Critical severity · published May 4, 2020
CVE-2020-1961
Vulnerability to Server-Side Template Injection on Mail templates for Apache Syncope 2.0.X releases prior to 2.0.15, 2.1.X releases prior to 2.1.6, enabling attackers to inject…
9.8
CVSS
4.8%
EPSS
No
On KEV
Description
Vulnerability to Server-Side Template Injection on Mail templates for Apache Syncope 2.0.X releases prior to 2.0.15, 2.1.X releases prior to 2.1.6, enabling attackers to inject arbitrary JEXL expressions, leading to Remote Code Execution (RCE) was discovered.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)4.8% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SY
Syncope · Apache
2.0.0 before 2.0.15; 2.1.0 before 2.1.6 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-1961
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-1961
Vendor Advisory
http://syncope.apache.org/security
More from Syncope
9.8
CVE-2026-62183
Apache Syncope: User self-service privilege escalation
9.8
CVE-2026-57308
Apache Syncope: SQL injection vulnerability in Audit Events search
9.8
CVE-2026-53421
Apache Syncope: Remote Code Execution via Scripted Connector
9.8
CVE-2026-53405
Apache Syncope: Remote Code Execution via Flowable BPMN Groovy ScriptTask
9.8
CVE-2026-63071
Apache Syncope: RCE via Groovy Sandbox bypass