CVE-2020-13942
Remote Code Execution in Apache Unomi
- State
- Published
- Severity
- Not scored
- Published
- Nov 24, 2020
- Updated
- Feb 13, 2025
- Reserved
- Jun 8, 2020
Description
It is possible to inject malicious OGNL or MVEL scripts into the /context.json public endpoint. This was partially fixed in 1.5.1 but a new attack vector was found. In Apache Unomi version 1.5.2 scripts are now completely filtered from the input. It is highly recommended to upgrade to the latest available version of the 1.5.x release to fix this problem.
Scores
The record has no CVSS score.
Weaknesses
- CWE-20 Improper Input Validation
Affected Products
| Product | Versions |
|---|---|
Apache UnomiApache Software Foundation |
|
References
- http://unomi.apache.org./security/cve-2020-13942.txt
- [unomi-dev] 20201124 CVE-2020-13942: Remote Code Execution in Apache Unomimailing-list
- [unomi-users] 20201124 CVE-2020-13942: Remote Code Execution in Apache Unomimailing-list
- [unomi-users] 20201124 Apache Unomi 1.5.4 Releasemailing-list
- [unomi-dev] 20201124 Apache Unomi 1.5.4 Releasemailing-list
- [oss-security] 20201124 CVE-2020-13942: Remote Code Execution in Apache Unomimailing-list
- [announce] 20201124 CVE-2020-13942: Remote Code Execution in Apache Unomimailing-list
- https://advisory.checkmarx.net/advisory/CX-2020-4284
- [unomi-commits] 20210428 svn commit: r1889256 - in /unomi/website: contribute-release-guide.html documentation.html download.html index.html security/cve-2021-31164.txtmailing-list
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.