GitHub Advisoryadvisory · Maven

GHSA-xp5j-wj4h-2jq9 Injection and Improper Input Validation in Apache Unomi

CRITICAL Published 2022-02-10 Modified 2021-04-14 Official page ↗
Aliases
CVE-2020-13942
Ecosystem
Maven
Packages
org.apache.unomi:unomi
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-20, CWE-74
Reviewed
2021-04-14

Affected packages

• Maven org.apache.unomi:unomi: < 1.5.2 → fixed in 1.5.2

Description

It is possible to inject malicious OGNL or MVEL scripts into the /context.json public endpoint. This was partially fixed in 1.5.1 but a new attack vector was found. In Apache Unomi version 1.5.2 scripts are now completely filtered from the input. It is highly recommended to upgrade to the latest available version of the 1.5.x release to fix this problem.

Related

Alias · CVE (1)

  • CVE-2020-13942 It is possible to inject malicious OGNL or MVEL scripts into the /context.json public endpoint. vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References