CVE-2020-11975

EPSS 82.71%
Published 05.06.2020 15:15:10
Last modified 21.11.2024 04:59:01
Source security@apache.org
Teams watchlist Login
Open Login

Apache Unomi allows conditions to use OGNL scripting which offers the possibility to call static Java classes from the JDK that could execute code with the permission level of the running Java process.

Affected products Warnungen 0 Metrics 3 CWE 0 References 6

Data is provided by the National Vulnerability Database (NVD)

Apache ≫ Unomi Version < 1.5.1

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	82.71%	0.992

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	9.8	3.9	5.9	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov	10	10	10	AV:N/AC:L/Au:N/C:C/I:C/A:C

http://unomi.apache.org/security/cve-2020-11975.txt

Patch

Vendor Advisory

https://lists.apache.org/thread.html/r01021bc4b25c1e98812efca0b07f0e078a6281bd52f7c3817a429d95%40%3Ccommits.unomi.apache.org%3E

https://lists.apache.org/thread.html/r79672c25e0ef9bb4b9148376281200a8e61c6d5ef5bb705e9a363460%40%3Ccommits.unomi.apache.org%3E

https://nvd.nist.gov/vuln/detail/CVE-2020-11975

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2020-11975

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2020-11975

EUVD