{"action":"Upgrade org.apache.syncope:syncope to 2.1.7 or later.","affected":[{"fixed":"2.1.7","introduced":"2.1.0"}],"component":"org.apache.syncope:syncope","cve_ids":["CVE-2020-11977"],"ecosystem":"Maven","epss":0.02862,"exploited":false,"fixed_versions":["2.1.7"],"ghsa_id":"GHSA-p2rp-cmjq-r7wm","id":"tcs_01M5N9684QS99GM5PDVGEGV11M","modified_at":"2023-11-08T04:02:08.242687Z","published_at":"2021-06-16T17:19:12Z","references":["https://osv.dev/vulnerability/GHSA-p2rp-cmjq-r7wm","https://nvd.nist.gov/vuln/detail/CVE-2020-11977","https://syncope.apache.org/security#CVE-2020-11977:_Remote_Code_Execution_via_Flowable_workflow_definition"],"severity":{"label":"high","score":7.2},"sources":[{"source":"osv","source_id":"GHSA-p2rp-cmjq-r7wm","url":"https://osv.dev/vulnerability/GHSA-p2rp-cmjq-r7wm"}],"summary":"Shell command injection in Apache Syncope"}