CVE-2020-13942
Remote Code Execution in Apache Unomi
CRITICAL 9.8EPSS 68.3%
It is possible to inject malicious OGNL or MVEL scripts into the /context.json public endpoint. This was partially fixed in 1.5.1 but a new attack vector was found. In Apache Unomi version 1.5.2 scripts are now completely filtered from the input. It is highly recommended to upgrade to the latest available version of the 1.5.x release to fix this problem.
- Affected
- Apache Software Foundation · Apache Unomi
- CVSS v3.1 NVD
- 9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS v2.0 NVD
- 7.5 HIGH
AV:N/AC:L/Au:N/C:P/I:P/A:P - EPSS
- 68.30% chance of exploitation in the next 30 days, 99th percentile
- Nuclei
- critical
- Published
- 2020-11-24
- Updated
- 2025-02-13
Proof-of-concept exploits (9)
- 1135/unomi_exploit6★ · 2020-12-01
- Prodrious/CVE-2020-139420★ · 2021-09-05
- blackmarketer/CVE-2020-139423★ · 2022-10-12
- corsisechero/CVE-2020-13942byVulHub0★ · 2025-04-02
- dev-team-12x/apche_unomi_rce0★ · 2021-01-12
- eugenebmx/CVE-2020-1394228★ · 2020-12-21
- hoanx4/apche_unomi_rce0★ · 2021-01-12
- lp008/CVE-2020-139426★ · 2020-11-19
- yaunsky/Unomi-CVE-2020-139424★ · 2020-12-22
Nuclei templates (1)
Vulhub environments (1)
Exploit collections (1)
- CVE-2020-13942 Apache Unomi 远程代码执行.mdtzwlhack/Vulnerability
Security advisories
- http://unomi.apache.org./security/cve-2020-13942.txt
- http://www.openwall.com/lists/oss-security/2020/11/24/5
- https://advisory.checkmarx.net/advisory/CX-2020-4284
- advisories/GHSA-xp5j-wj4h-2jq9