Log in Start free

Vulnerability · Published Nov 24, 2020 · Assigned by apache

CVE-2020-13942Remote Code Execution in Apache Unomi

Critical 9.8

In plain English

A critical-severity improper input validation in Apache Unomi from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 68.5% (higher than 99.3% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)68.5%top 0.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling2Nuclei, Public PoC

Official description

It is possible to inject malicious OGNL or MVEL scripts into the /context.json public endpoint. This was partially fixed in 1.5.1 but a new attack vector was found. In Apache Unomi version 1.5.2 scripts are now completely filtered from the input. It is highly recommended to upgrade to the latest available version of the 1.5.x release to fix this problem.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenorg.apache.unomi:unomi1.5.2GHSA-xp5j-wj4h-2jq9

Affected products (as reported)

VendorProductVersions
Apache Software Foundation Apache Unomi unspecified – before 1.5.2

Weakness: CWE-20

References