unomi.apache.org
http://unomi.apache.org/security/cve-2020-11975.txt CVE-2020-11975
CRITICALNuclei
Improper Input Validation in Apache Unomi
Record summary
CVE-2020-11975 has a selected CVSS score of 9.8 (critical); EIP currently links 1 repository PoC and 1 Nuclei template.
Description
Apache Unomi allows conditions to use OGNL scripting which offers the possibility to call static Java classes from the JDK that could execute code with the permission level of the running Java process.
Description source: CVE List
Exploitation context
Affected products and versions
3| Product | Source | Version range | Status |
|---|---|---|---|
| VulnCheck | Version data not supplied | ||
Apache Unomi | CVE List | Apache Unomi 1.0.0 to 1.5.0 | affected |
org.apache.unomi:unomiBrowse Maven / org.apache.unomi:unomi | GitHub Advisory | Before 1.5.4 · Fixed in 1.5.4 | affected |
Proofs of concept
1Repository PoCs
GitHub1135/unomi_exploitRepository PoCby 1135Stars: 6Not analyzed1 file
Nuclei templates
1ProjectDiscoveryCRITICALApache Unomi - Remote Code ExecutionCVSS 9.8
Apache Unomi allows conditions to use OGNL scripting which offers the possibility to call static Java classes from the JDK that could execute code with the permission level of the running Java process, enabling attackers to execute arbitrary code.
Impact
Successful exploitation allows an attacker to execute arbitrary code on the server with the privileges of the Java process, potentially leading to complete system compromise.
Remediation
Update Apache Unomi to version 1.5.2 or later. Disable OGNL scripting in conditions if not required.
WeaknessesCWE-94
AuthorsSourabh-Sahu
Template tagscvecve2020apacheunomirceognloastvkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:apache:unomi:*:*:*:*:*:*:*:*
Shodan: http.title:"Apache Unomi"
FOFA: title="Apache Unomi"
https://xz.aliyun.com/news/8157 https://github.com/1135/unomi_exploit https://unomi.apache.org/security/cve-2020-11975.html https://nvd.nist.gov/vuln/detail/CVE-2020-11975
Source: ProjectDiscovery
References
6[unomi-commits] 20201113 svn commit: r1883398 - in /unomi/website: contribute-release-guide.html documentation.html download.html index.html security/cve-2020-13942.txtmailing list
https://lists.apache.org/thread.html/r01021bc4b25c1e98812efca0b07f0e078a6281bd52f7c3817a429d95%40%3Ccommits.unomi.apache.org%3E lists.apache.org
https://lists.apache.org/thread.html/r01021bc4b25c1e98812efca0b07f0e078a6281bd52f7c3817a429d95@%3Ccommits.unomi.apache.org%3E [unomi-commits] 20210428 svn commit: r1889256 - in /unomi/website: contribute-release-guide.html documentation.html download.html index.html security/cve-2021-31164.txtmailing list
https://lists.apache.org/thread.html/r79672c25e0ef9bb4b9148376281200a8e61c6d5ef5bb705e9a363460%40%3Ccommits.unomi.apache.org%3E lists.apache.org
https://lists.apache.org/thread.html/r79672c25e0ef9bb4b9148376281200a8e61c6d5ef5bb705e9a363460@%3Ccommits.unomi.apache.org%3E nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2020-11975