Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2020-13942
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Remote Code Execution in Apache Unomi
Source: NVD (National Vulnerability Database)
Vulnerability Description
It is possible to inject malicious OGNL or MVEL scripts into the /context.json public endpoint. This was partially fixed in 1.5.1 but a new attack vector was found. In Apache Unomi version 1.5.2 scripts are now completely filtered from the input. It is highly recommended to upgrade to the latest available version of the 1.5.x release to fix this problem.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
输入验证不恰当
Source: NVD (National Vulnerability Database)
Vulnerability Title
Apache Unomi 注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache Unomi是美国阿帕奇软件（Apache Software）基金会的一套开源的客户数据平台。该平台主要使用Java语言编写。 Apache Unomi 1.5.2之前版本存在注入漏洞，该漏洞源于可以将恶意的OGNL或MVEL脚本注入/context.json公共端点。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
VendorProductAffected VersionsCPESubscribe
Apache Software FoundationApache Unomi unspecified ~ 1.5.2 -
II. Public POCs for CVE-2020-13942
#POC DescriptionSource LinkShenlong Link
1Nonehttps://github.com/lp008/CVE-2020-13942POC Details
2CVE-2020-13942 unauthenticated RCE POC through MVEL and OGNL injectionhttps://github.com/eugenebmx/CVE-2020-13942POC Details
3CVE-2020-13942 POC + Automation Scripthttps://github.com/shifa123/CVE-2020-13942-POC-POC Details
4Nonehttps://github.com/blackmarketer/CVE-2020-13942POC Details
5CVE-2020-13942 Apache Unomi 远程代码执行漏洞脚getshellhttps://github.com/yaunsky/Unomi-CVE-2020-13942POC Details
6Apache Unomi CVE-2020-13942: RCE Vulnerabilitieshttps://github.com/hoanx4/apche_unomi_rcePOC Details
7Nonehttps://github.com/Prodrious/CVE-2020-13942POC Details
8Nonehttps://github.com/corsisechero/CVE-2020-13942byVulHubPOC Details
9Apache Unomi allows conditions to use OGNL and MVEL scripting which offers the possibility to call static Java classes from the JDK that could execute code with the permission level of the running Java process. This vulnerability affects all versions of Apache Unomi prior to 1.5.2. https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-13942.yamlPOC Details
10Nonehttps://github.com/Threekiii/Awesome-POC/blob/master/Web%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E/Apache%20Unomi%20%E8%BF%9C%E7%A8%8B%E8%A1%A8%E8%BE%BE%E5%BC%8F%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E%20CVE-2020-13942.mdPOC Details
11https://github.com/vulhub/vulhub/blob/master/unomi/CVE-2020-13942/README.mdPOC Details
12Apache Unomi CVE-2020-13942: RCE Vulnerabilitieshttps://github.com/dev-team-12x/apche_unomi_rcePOC Details
AI-Generated POCPremium

No public POC found.

Login to generate AI POC
III. Intelligence Information for CVE-2020-13942
Please Login to view more intelligence information
IV. Related Vulnerabilities
Same product: Apache Unomi
Same vendor: Apache Software Foundation
Same weakness: CWE-20
V. Comments for CVE-2020-13942

No comments yet

Leave a comment