CVE-2020-1961: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

June 16, 2021

Vulnerability to Server-Side Template Injection on Mail templates for Apache Syncope 2.0.X releases prior to 2.0.15, 2.1.X releases prior to 2.1.6, enabling attackers to inject arbitrary JEXL expressions, leading to Remote Code Execution (RCE) was discovered.

References

github.com/advisories/GHSA-4w4p-xwrr-9crh
nvd.nist.gov/vuln/detail/CVE-2020-1961

Detect and mitigate CVE-2020-1961 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →