CVE-2020-11975 Improper Input Validation in Apache Unomi
Attackers can execute arbitrary code via OGNL scripting in Apache Unomi conditions, requiring immediate upgrade to secure the Java process.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-11975?
CVE-2020-11975 is a critical code injection vulnerability in Apache Unomi, published on 5 Jun 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Apache Unomi allows conditions to use OGNL scripting which offers the possibility to call static Java classes from the JDK that could execute code with the permission level of the running Java process.
Which versions are affected by CVE-2020-11975?
2 open source packages ship an affected version, including org.apache.unomi:unomi. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.unomi:unomi Maven | All versions | 1.5.4 |
org.apache.unomi:unomi Maven | All versions | 1.5.4 |
Products include Apache Unomi.
How do I fix CVE-2020-11975?
Upgrade org.apache.unomi:unomi to 1.5.4 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2020-11975 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-11975 exists.
Public exploit code: 1 Nuclei template and 1 proofs of concept on GitHub.
Other vulnerabilities in Apache Unomi
Sources
Also known as GHSA-v6fq-q792-j46j.