CVE-2020-13942
CRITICAL 9.8EPSS 68.4%
It is possible to inject malicious OGNL or MVEL scripts into the /context.json public endpoint. This was partially fixed in 1.5.1 but a new attack vector was found. In Apache Unomi version 1.5.2 scripts are now completely filtered from the input. It is highly recommended to upgrade to the latest available version of the 1.5.x release to fix this problem.
- CVSS v3.1
- 9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS v3.1
- 9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS v2.0
- 7.5 HIGH
AV:N/AC:L/Au:N/C:P/I:P/A:P - EPSS
- 68.40% chance of exploitation in the next 30 days, 99th percentile
- Nuclei
- critical
- Published
- 2020-11-24
- Updated
- 2025-02-13
Proof-of-concept exploits (10)
- 1135/unomi_exploit6★ · 2020-12-01
- Prodrious/CVE-2020-139420★ · 2021-09-05
- blackmarketer/CVE-2020-139423★ · 2022-10-12
- corsisechero/CVE-2020-13942byVulHub0★ · 2025-04-02
- dev-team-12x/apche_unomi_rce0★ · 2021-01-12
- eugenebmx/CVE-2020-1394228★ · 2020-12-21
- hoanx4/apche_unomi_rce0★ · 2021-01-12
- lp008/CVE-2020-139426★ · 2020-11-19
- shifa123/CVE-2020-13942-POC-9★ · 2020-11-23
- yaunsky/Unomi-CVE-2020-139424★ · 2020-12-22