Apache Software Foundation · Apache Unomi
Apache Unomi contains an improper input validation flaw in its public /context.json endpoint that allows malicious OGNL or MVEL scripts to be injected. An attacker can exploit this by sending crafted requests to that endpoint.
It is possible to inject malicious OGNL or MVEL scripts into the /context.json public endpoint. This was partially fixed in 1.5.1 but a new attack vector was found. In Apache Unomi version 1.5.2 scripts are now completely filtered from the input. It is highly recommended to upgrade to the latest available version of the 1.5.x release to fix this problem.
First seen exploited 5 months after disclosure. Public exploit code (PoC-in-GitHub) was available 6 days before disclosure.
No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
1 package in 1 ecosystem. Main package: org.apache.unomi:unomi.
Upgrade to 1.5.4 or later
Fixes this CVE and 1 other known vulnerability in this package (CVE-2020-11975).
Set the version to 1.5.4 or later in your pom.xml or build.gradle.
First fixed in 1.5.2 for CVE-2020-13942.
| If you run | Upgrade to |
|---|---|
| All versions before 1.5.2 | 1.5.4first fix for this CVE: 1.5.2 |
“Up to” means the second version is the fix and is not affected.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.