CVE-2020-1961

CVE-2020-1961 is a critical Server-Side Template Injection vulnerability affecting Apache Syncope versions 2.0.x prior to 2.0.15 and 2.1.x prior to 2.1.6. This flaw allows unauthenticated attackers to inject arbitrary JEXL expressions into mail templates, leading to Remote Code Execution (RCE). With a CVSS score of 9.8, it represents a severe risk due to its network-based attack vector, low attack complexity, and complete compromise of confidentiality, integrity, and availability. While no active exploitation, public exploit code, or significant community discussion has been observed, the high EPSS and FAUCET Risk Score indicate its potential for future exploitation.