GitHub Advisoryadvisory · Maven

GHSA-59j4-wjwp-mw9m Sandbox Bypass in Apache Velocity Engine

HIGH Published 2022-01-06 Modified 2022-04-01 Official page ↗
Aliases
CVE-2020-13936
Ecosystem
Maven
Packages
org.apache.velocity:velocity-engine-parent, org.apache.velocity:velocity
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-20
Reviewed
2021-03-17

Affected packages

• Maven org.apache.velocity:velocity-engine-parent: < 2.3 → fixed in 2.3 • Maven org.apache.velocity:velocity: <= 1.7 (no fix yet)

Description

An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache Velocity Engine versions up to 2.2.

Related

Alias · CVE (1)

  • CVE-2020-13936 An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References