{"id":"CVE-2020-13942","published":"2020-11-24T18:00:16Z","modified":"2025-02-13T16:27:30Z","title":"Remote Code Execution in Apache Unomi","vendor":"Apache Software Foundation","product":"Apache Unomi","tier":"core","eol":null,"affectedVersions":[{"vendor":"Apache Software Foundation","product":"Apache Unomi","versions":[">= unspecified, < 1.5.2"]}],"description":{"text":"It is possible to inject malicious OGNL or MVEL scripts into the /context.json public endpoint. This was partially fixed in 1.5.1 but a new attack vector was found. In Apache Unomi version 1.5.2 scripts are now completely filtered from the input. It is highly recommended to upgrade to the latest available version of the 1.5.x release to fix this problem.","provenance":"source","from":"CVE.org"},"summary":{"text":"Apache Unomi contains an improper input validation flaw in its public /context.json endpoint that allows malicious OGNL or MVEL scripts to be injected. An attacker can exploit this by sending crafted requests to that endpoint.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:16:58Z"},"cvss":null,"epss":{"score":0.68296,"percentile":0.99331,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2021-04-12","exploitedFirstSeen":"2021-04-12","ransomware":false,"evidence":[{"url":"https://unit42.paloaltonetworks.com/network-attack-trends-winter-2020/","date":"2021-04-12"},{"url":"https://cujo.com/the-sysrv-botnet-and-how-it-evolved/","date":"2021-09-22"},{"url":"https://www.botconf.eu/wp-content/uploads/2022/05/Botconf2022-24-PalotayZsigovits.pdf","date":"2022-04-27"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-22&host_type=src&vulnerability=cve-2020-13942","date":"2023-11-22"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-05&host_type=src&vulnerability=cve-2020-13942","date":"2023-12-05"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-06&host_type=src&vulnerability=cve-2020-13942","date":"2023-12-06"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-11&host_type=src&vulnerability=cve-2020-13942","date":"2023-12-11"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-19&host_type=src&vulnerability=cve-2020-13942","date":"2023-12-19"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-02&host_type=src&vulnerability=cve-2020-13942","date":"2024-01-02"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-04&host_type=src&vulnerability=cve-2020-13942","date":"2024-01-04"}],"evidenceTotal":761,"provenance":"source"},"exploited":true,"otx":{"pulseCount":1,"pulses":[{"name":"Thor Lite Scan - 10.7.15 - Ubuntu Scan on Archived Files","url":"https://otx.alienvault.com/pulse/664cc3c1938ed0b9abf026a2","created":"2024-05-21"}],"provenance":"machine"},"cwes":[{"id":"CWE-20","name":"Improper Input Validation"}],"references":[{"url":"http://unomi.apache.org./security/cve-2020-13942.txt","tags":["x_refsource_MISC"]},{"url":"https://lists.apache.org/thread.html/rcb6d2eafcf15def433aaddfa06738e5faa5060cef2647769e178999a%40%3Cdev.unomi.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/rcb6d2eafcf15def433aaddfa06738e5faa5060cef2647769e178999a%40%3Cusers.unomi.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r4a8fa91836687eaca42b5420a778ca8c8fd3a3740e4cf4401acc9118%40%3Cusers.unomi.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r4a8fa91836687eaca42b5420a778ca8c8fd3a3740e4cf4401acc9118%40%3Cdev.unomi.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://www.openwall.com/lists/oss-security/2020/11/24/5","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r08a4057ff7196b8880117edaa4b6207cbd36ed692d8dd1f5a56b4d0f%40%3Cannounce.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://advisory.checkmarx.net/advisory/CX-2020-4284","tags":["x_refsource_MISC"]},{"url":"https://lists.apache.org/thread.html/r79672c25e0ef9bb4b9148376281200a8e61c6d5ef5bb705e9a363460%40%3Ccommits.unomi.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.apache.unomi:unomi","vulnerableRanges":["<1.5.2"],"patched":["1.5.2"],"from":["GHSA-xp5j-wj4h-2jq9"],"provenance":"source"}],"advisories":[{"id":"GHSA-xp5j-wj4h-2jq9","url":"https://github.com/advisories/GHSA-xp5j-wj4h-2jq9","severity":"CRITICAL","ecosystem":"Maven","package":"org.apache.unomi:unomi","vulnerableRanges":["<1.5.2"],"patched":["1.5.2"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2022-1257","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-1257","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":7,"skipped":2,"earliest":"2020-11-18","earliestUrl":"https://github.com/lp008/CVE-2020-13942","repos":[{"name":"eugenebmx/CVE-2020-13942","url":"https://github.com/eugenebmx/CVE-2020-13942","stars":28,"created":"2020-11-19"},{"name":"shifa123/CVE-2020-13942-POC-","url":"https://github.com/shifa123/CVE-2020-13942-POC-","stars":8,"created":"2020-11-20"},{"name":"lp008/CVE-2020-13942","url":"https://github.com/lp008/CVE-2020-13942","stars":6,"created":"2020-11-18"},{"name":"yaunsky/Unomi-CVE-2020-13942","url":"https://github.com/yaunsky/Unomi-CVE-2020-13942","stars":4,"created":"2020-12-22"},{"name":"blackmarketer/CVE-2020-13942","url":"https://github.com/blackmarketer/CVE-2020-13942","stars":3,"created":"2020-11-21"}]},"nuclei":[{"id":"CVE-2020-13942","name":"Apache Unomi <1.5.2 - Remote Code Execution","severity":"critical","path":"http/cves/2020/CVE-2020-13942.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-13942.yaml"}],"first":{"date":"2020-11-18","source":"PoC-in-GitHub","url":"https://github.com/lp008/CVE-2020-13942"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2020-11-18","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/lp008/CVE-2020-13942","provenance":"source"},{"date":"2020-11-24","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2020-13942","provenance":"source"},{"date":"2021-04-12","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://unit42.paloaltonetworks.com/network-attack-trends-winter-2020/","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":60.5,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2028 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.87,"detail":"percentile 0.9933"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"7 PoC-in-GitHub repos; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.68,"detail":"1 pulse"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}