CVE-2020-13936

EPSS 22.71%
Veröffentlicht 10.03.2021 08:15:14
Zuletzt bearbeitet 21.11.2024 05:02:11
Erkennungen
Login

Velocity Sandbox Bypass

An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache Velocity Engine versions up to 2.2.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 0 Referenzen 26

NVD 28 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Apache ≫ Velocity Engine Version < 2.3

Apache ≫ Wss4j Version 2.3.1

Debian ≫ Debian Linux Version 9.0

Oracle ≫ Banking Deposits And Lines Of Credit Servicing Version 2.12.0

Oracle ≫ Banking Enterprise Default Management Version >= 2.3.0 <= 2.4.1

Oracle ≫ Banking Enterprise Default Management Version 2.6.2

Oracle ≫ Banking Enterprise Default Management Version 2.7.1

Oracle ≫ Banking Enterprise Default Management Version 2.10.0

Oracle ≫ Banking Enterprise Default Management Version 2.12.0

Oracle ≫ Banking Loans Servicing Version 2.12.0

Oracle ≫ Banking Party Management Version 2.7.0

Oracle ≫ Banking Platform Version >= 2.3.0 <= 2.4.1

Oracle ≫ Banking Platform Version 2.6.2

Oracle ≫ Banking Platform Version 2.7.1

Oracle ≫ Communications Cloud Native Core Policy Version 1.14.0

Oracle ≫ Communications Network Integrity Version 7.3.6

Oracle ≫ Hospitality Token Proxy Service Version 19.2

Oracle ≫ Retail Integration Bus Version 19.0.1

Oracle ≫ Retail Order Broker Version 16.0

Oracle ≫ Retail Service Backbone Version 19.0.1

Oracle ≫ Retail Xstore Office Cloud Service Version 16.0.6

Oracle ≫ Retail Xstore Office Cloud Service Version 17.0.4

Oracle ≫ Retail Xstore Office Cloud Service Version 18.0.3

Oracle ≫ Retail Xstore Office Cloud Service Version 19.0.2

Oracle ≫ Retail Xstore Office Cloud Service Version 20.0.1

Oracle ≫ Utilities Testing Accelerator Version 6.0.0.1.1

Oracle ≫ Utilities Testing Accelerator Version 6.0.0.2.2

Oracle ≫ Utilities Testing Accelerator Version 6.0.0.3.1

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	22.71%	0.974

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	8.8	2.8	5.9	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NIST	9	8	10	AV:N/AC:L/Au:S/C:C/I:C/A:C

Es wurden noch keine Informationen zu CWE veröffentlicht.

https://www.oracle.com/security-alerts/cpuapr2022.html

Patch

Third Party Advisory

https://www.oracle.com/security-alerts/cpujan2022.html

Patch

Third Party Advisory

https://lists.apache.org/thread.html/r52a5129df402352adc34d052bab9234c8ef63596306506a89fdc7328%40%3Cusers.activemq.apache.org%3E

https://lists.apache.org/thread.html/r9dc2505651788ac668299774d9e7af4dc616be2f56fdc684d1170882%40%3Cusers.activemq.apache.org%3E

http://www.openwall.com/lists/oss-security/2021/03/10/1

Third Party Advisory

Mailing List

https://lists.apache.org/thread.html/r01043f584cbd47959fabe18fff64de940f81a65024bb8dddbda31d9a%40%3Cuser.velocity.apache.org%3E

Vendor Advisory

Mailing List

https://lists.apache.org/thread.html/r0bc98e9cd080b4a13b905c571b9bed87e1a0878d44dbf21487c6cca4%40%3Cdev.santuario.apache.org%3E

https://lists.apache.org/thread.html/r17cb932fab14801b14e5b97a7f05192f4f366ef260c10d4a8dba8ac9%40%3Cdev.ws.apache.org%3E

https://lists.apache.org/thread.html/r293284c6806c73f51098001ea86a14271c39f72cd76af9e946d9d9ad%40%3Cdev.ws.apache.org%3E

https://lists.apache.org/thread.html/r39de20c7e9c808b1f96790875d33e58c9c0aabb44fd9227e7b3dc5da%40%3Cdev.ws.apache.org%3E

https://lists.apache.org/thread.html/r3ea4c4c908505b20a4c268330dfe7188b90c84dcf777728d02068ae6%40%3Cannounce.apache.org%3E

https://lists.apache.org/thread.html/r4cd59453b65d4ac290fcb3b71fdf32b4f1f8989025e89558deb5a245%40%3Cdev.ws.apache.org%3E

https://lists.apache.org/thread.html/r7f209b837217d2a0fe5977fb692e7f15d37fa5de8214bcdc4c21d9a7%40%3Ccommits.turbine.apache.org%3E

https://lists.apache.org/thread.html/rb042f3b0090e419cc9f5a3d32cf0baff283ccd6fcb1caea61915d6b6%40%3Ccommits.velocity.apache.org%3E

https://lists.apache.org/thread.html/rbee7270556f4172322936b5ecc9fabf0c09f00d4fa56c9de1963c340%40%3Cdev.ws.apache.org%3E

https://lists.apache.org/thread.html/rd2a89e17e8a9b451ce655f1a34117752ea1d18a22ce580d8baa824fd%40%3Ccommits.druid.apache.org%3E

https://lists.apache.org/thread.html/rd7e865c87f9043c21d9c1fd9d4df866061d9a08cfc322771160d8058%40%3Cdev.ws.apache.org%3E

https://lists.apache.org/thread.html/re641197d204765130618086238c73dd2ce5a3f94b33785b587d72726%40%3Cdev.ws.apache.org%3E

https://lists.apache.org/thread.html/re8e7482fe54d289fc0229e61cc64947b63b12c3c312e9f25bf6f3b8c%40%3Cdev.ws.apache.org%3E

https://lists.apache.org/thread.html/reab5978b54a9f4c078402161e30a89c42807b198814acadbe6c862c7%40%3Cdev.ws.apache.org%3E

https://lists.apache.org/thread.html/rf7d369de88dc88a1347006a3323b3746d849234db40a8edfd5ebc436%40%3Cdev.ws.apache.org%3E

https://lists.debian.org/debian-lts-announce/2021/03/msg00019.html

Third Party Advisory

Mailing List

https://security.gentoo.org/glsa/202107-52

Third Party Advisory

https://nvd.nist.gov/vuln/detail/CVE-2020-13936

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2020-13936

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2020-13936

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2020-13936