CVE-2020-11975

Apache Unomi allows conditions to use OGNL scripting which offers the possibility to call static Java classes from the JDK that could execute code with the permission level of the running Java process.

Affected

Apache Unomi

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS

30.61% chance of exploitation in the next 30 days, 98th percentile

Nuclei

critical · CWE-94

Published

2020-06-05

Updated

2024-08-04

Proof-of-concept exploits (1)

• 1135/unomi_exploit6★ · 2020-12-01

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-11975.yaml

Security advisories

• http://unomi.apache.org/security/cve-2020-11975.txt
• advisories/GHSA-v6fq-q792-j46j

References

• CVE Record
• NVD entry

Related

• CVE-2019-0193
• CVE-2020-11710
• CVE-2020-13942