cve-2020-13942

CRITICAL CVSS 9.8 opencve

Description

It is possible to inject malicious OGNL or MVEL scripts into the /context.json public endpoint. This was partially fixed in 1.5.1 but a new attack vector was found. In Apache Unomi version 1.5.2 scripts are now completely filtered from the input. It is highly recommended to upgrade to the latest available version of the 1.5.x release to fix this problem.

Timeline

Published: 2020-11-24 18:15 UTC
Last Modified: 2026-06-17

CVSS Details

CVSS details not available.

Affected Products

No product information available.

Weaknesses (CWE)

CWE-20 CWE-74

CVSS metrics

Version	Base	Severity	Vector	Exploitability	Impact	Source
3.1	9.8	CRITICAL	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`			nvd
3.1	9.8	CRITICAL	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`			opencve

References

No references available.

Linked Vulnerabilities

No linked vulnerabilities found.

{
  "advisories": [
    {
      "id": "GHSA-xp5j-wj4h-2jq9",
      "source": "ghsa",
      "title": "Injection and Improper Input Validation in Apache Unomi",
      "url": "https://github.com/advisories/GHSA-xp5j-wj4h-2jq9"
    }
  ],
  "cve": "CVE-2020-13942",
  "epss": {
    "score": 0.68296
  },
  "mitre": {
    "cpes": [],
    "created": "2020-11-24T18:00:16+00:00",
    "description": "It is possible to inject malicious OGNL or MVEL scripts into the /context.json public endpoint. This was partially fixed in 1.5.1 but a new attack vector was found. In Apache Unomi version 1.5.2 scripts are now completely filtered from the input. It is highly recommended to upgrade to the latest available version of the 1.5.x release to fix this problem.",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {},
      "cvssV4_0": {}
    },
    "mitre_repo_path": "cves/2020/13xxx/CVE-2020-13942.json",
    "references": [
      "http://unomi.apache.org./security/cve-2020-13942.txt",
      "http://www.openwall.com/lists/oss-security/2020/11/24/5",
      "https://advisory.checkmarx.net/advisory/CX-2020-4284",
      "https://lists.apache.org/thread.html/r08a4057ff7196b8880117edaa4b6207cbd36ed692d8dd1f5a56b4d0f%40%3Cannounce.apache.org%3E",
      "https://lists.apache.org/thread.html/r4a8fa91836687eaca42b5420a778ca8c8fd3a3740e4cf4401acc9118%40%3Cdev.unomi.apache.org%3E",
      "https://lists.apache.org/thread.html/r4a8fa91836687eaca42b5420a778ca8c8fd3a3740e4cf4401acc9118%40%3Cusers.unomi.apache.org%3E",
      "https://lists.apache.org/thread.html/r79672c25e0ef9bb4b9148376281200a8e61c6d5ef5bb705e9a363460%40%3Ccommits.unomi.apache.org%3E",
      "https://lists.apache.org/thread.html/rcb6d2eafcf15def433aaddfa06738e5faa5060cef2647769e178999a%40%3Cdev.unomi.apache.org%3E",
      "https://lists.apache.org/thread.html/rcb6d2eafcf15def433aaddfa06738e5faa5060cef2647769e178999a%40%3Cusers.unomi.apache.org%3E"
    ],
    "title": "Remote Code Execution in Apache Unomi",
    "updated": "2025-02-13T16:27:30.019000+00:00",
    "vendors": [],
    "weaknesses": [
      "CWE-20"
    ]
  },
  "nvd": {
    "cpes": [
      "cpe:2.3:a:apache:unomi:*:*:*:*:*:*:*:*"
    ],
    "created": "2020-11-24T18:15:11.910000+00:00",
    "description": "It is possible to inject malicious OGNL or MVEL scripts into the /context.json public endpoint. This was partially fixed in 1.5.1 but a new attack vector was found. In Apache Unomi version 1.5.2 scripts are now completely filtered from the input. It is highly recommended to upgrade to the latest available version of the 1.5.x release to fix this problem.",
    "metrics": {
      "cvssV2_0": {
        "score": 7.5,
        "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"
      },
      "cvssV3_0": {},
      "cvssV3_1": {
        "score": 9.8,
        "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
      },
      "cvssV4_0": {}
    },
    "nvd_repo_path": "2020/CVE-2020-13942.json",
    "references": [
      "http://unomi.apache.org./security/cve-2020-13942.txt",
      "http://www.openwall.com/lists/oss-security/2020/11/24/5",
      "https://advisory.checkmarx.net/advisory/CX-2020-4284",
      "https://lists.apache.org/thread.html/r08a4057ff7196b8880117edaa4b6207cbd36ed692d8dd1f5a56b4d0f%40%3Cannounce.apache.org%3E",
      "https://lists.apache.org/thread.html/r4a8fa91836687eaca42b5420a778ca8c8fd3a3740e4cf4401acc9118%40%3Cdev.unomi.apache.org%3E",
      "https://lists.apache.org/thread.html/r4a8fa91836687eaca42b5420a778ca8c8fd3a3740e4cf4401acc9118%40%3Cusers.unomi.apache.org%3E",
      "https://lists.apache.org/thread.html/r79672c25e0ef9bb4b9148376281200a8e61c6d5ef5bb705e9a363460%40%3Ccommits.unomi.apache.org%3E",
      "https://lists.apache.org/thread.html/rcb6d2eafcf15def433aaddfa06738e5faa5060cef2647769e178999a%40%3Cdev.unomi.apache.org%3E",
      "https://lists.apache.org/thread.html/rcb6d2eafcf15def433aaddfa06738e5faa5060cef2647769e178999a%40%3Cusers.unomi.apache.org%3E"
    ],
    "title": null,
    "updated": "2026-06-17T02:53:56.880000+00:00",
    "vendors": [
      "apache",
      "apache$PRODUCT$unomi"
    ],
    "weaknesses": [
      "CWE-20",
      "CWE-74"
    ]
  },
  "opencve": {
    "changes": [],
    "cpes": {
      "data": [
        "cpe:2.3:a:apache:unomi:*:*:*:*:*:*:*:*"
      ],
      "providers": [
        "nvd"
      ]
    },
    "created": {
      "data": "2020-11-24T18:00:16+00:00",
      "provider": "mitre"
    },
    "description": {
      "data": "It is possible to inject malicious OGNL or MVEL scripts into the /context.json public endpoint. This was partially fixed in 1.5.1 but a new attack vector was found. In Apache Unomi version 1.5.2 scripts are now completely filtered from the input. It is highly recommended to upgrade to the latest available version of the 1.5.x release to fix this problem.",
      "provider": "mitre"
    },
    "metrics": {
      "cvssV2_0": {
        "data": {
          "score": 7.5,
          "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"
        },
        "provider": "nvd"
      },
      "cvssV3_0": {
        "data": {},
        "provider": null
      },
      "cvssV3_1": {
        "data": {
          "score": 9.8,
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
        },
        "provider": "nvd"
      },
      "cvssV4_0": {
        "data": {},
        "provider": null
      },
      "epss": {
        "data": {
          "score": 0.68296
        },
        "provider": "first"
      },
      "kev": {
        "data": {},
        "provider": null
      },
      "ssvc": {
        "data": {},
        "provider": null
      },
      "threat_severity": {
        "data": null,
        "provider": null
      }
    },
    "references": {
      "data": [
        "http://unomi.apache.org./security/cve-2020-13942.txt",
        "http://www.openwall.com/lists/oss-security/2020/11/24/5",
        "https://advisory.checkmarx.net/advisory/CX-2020-4284",
        "https://lists.apache.org/thread.html/r08a4057ff7196b8880117edaa4b6207cbd36ed692d8dd1f5a56b4d0f%40%3Cannounce.apache.org%3E",
        "https://lists.apache.org/thread.html/r4a8fa91836687eaca42b5420a778ca8c8fd3a3740e4cf4401acc9118%40%3Cdev.unomi.apache.org%3E",
        "https://lists.apache.org/thread.html/r4a8fa91836687eaca42b5420a778ca8c8fd3a3740e4cf4401acc9118%40%3Cusers.unomi.apache.org%3E",
        "https://lists.apache.org/thread.html/r79672c25e0ef9bb4b9148376281200a8e61c6d5ef5bb705e9a363460%40%3Ccommits.unomi.apache.org%3E",
        "https://lists.apache.org/thread.html/rcb6d2eafcf15def433aaddfa06738e5faa5060cef2647769e178999a%40%3Cdev.unomi.apache.org%3E",
        "https://lists.apache.org/thread.html/rcb6d2eafcf15def433aaddfa06738e5faa5060cef2647769e178999a%40%3Cusers.unomi.apache.org%3E"
      ],
      "providers": [
        "mitre",
        "nvd"
      ]
    },
    "title": {
      "data": "Remote Code Execution in Apache Unomi",
      "provider": "mitre"
    },
    "updated": {
      "data": "2025-02-13T16:27:30.019000+00:00",
      "provider": "mitre"
    },
    "vendors": {
      "data": [
        "apache",
        "apache$PRODUCT$unomi"
      ],
      "providers": [
        "nvd"
      ]
    },
    "weaknesses": {
      "data": [
        "CWE-20",
        "CWE-74"
      ],
      "providers": [
        "mitre",
        "nvd"
      ]
    }
  }
}

cve-2020-13942

Raw JSON Data