CVE-2020-11977

What’s affected: Apache Syncope 2.1.x (before 2.1.7) with the Flowable extension enabled. Vulnerability: An administrator with workflow entitlements can use Shell Service Tasks to perform malicious operations, including file reads/writes and code execution. Root cause (per sources): Flowable work...