Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2020-13942

CWE-20 — Improper Input ValidationCWE-748 documents7 sources
Severity
9.8CRITICAL
EPSS
94.3%
top 0.06%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
2
Apache Software Foundation Apache UnomiApache Unomi
Timeline
PublishedNov 24
Latest updateFeb 10

Description

It is possible to inject malicious OGNL or MVEL scripts into the /context.json public endpoint. This was partially fixed in 1.5.1 but a new attack vector was found. In Apache Unomi version 1.5.2 scripts are now completely filtered from the input. It is highly recommended to upgrade to the latest available version of the 1.5.x release to fix this problem.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages3 packages

▶CVEListV5apache_software_foundation/apache_unomiunspecified — 1.5.2
▶NVDapache/unomi1.5.0 — 1.5.2
▶Mavenorg.apache.unomi:unomi< 1.5.2

🔴Vulnerability Details

4
OSV
Injection and Improper Input Validation in Apache Unomi↗2022-02-10
▶
GHSA
Injection and Improper Input Validation in Apache Unomi↗2022-02-10
▶
CVEList
Remote Code Execution in Apache Unomi↗2020-11-24
▶
VulnCheck
Apache unomi Improper Input Validation↗2020
▶

💥Exploits & PoCs

1
Nuclei
Apache Unomi <1.5.2 - Remote Code Execution
▶

🔍Detection Rules

2
Suricata
ET WEB_SPECIFIC_APPS Possible Apache Unomi MVEL Eval RCE Inbound M1 (CVE-2020-13942)↗2020-11-19
▶
Suricata
ET WEB_SPECIFIC_APPS Possible Apache Unomi OGNL Eval RCE Inbound M2 (CVE-2020-13942)↗2020-11-19
▶
CVE-2020-13942 (CRITICAL CVSS 9.8) | It is possible to inject malicious | cvebase.io