CVE-2020-14987 Code injection in n/a
Remote attackers can execute arbitrary code in Bloomreach Experience Manager by exploiting Groovy script handling in the updater editor.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-14987?
CVE-2020-14987 is a high-severity code injection vulnerability in n/a, published on 11 Mar 2021. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
An issue was discovered in Bloomreach Experience Manager (brXM) 4.1.0 through 14.2.2. It allows remote attackers to execute arbitrary code because there is a mishandling of the capability for administrators to write and run Groovy scripts within the updater editor. An attacker must use an AST transforming annotation such as @Grab.
Which versions are affected by CVE-2020-14987?
It affects 1 product.
Products include Bloomreach Experience Manager.
How do I fix CVE-2020-14987?
No fix has been published for CVE-2020-14987 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2020-14987 being exploited?
There is no known exploitation of CVE-2020-14987 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-59pc-38q9-x2p3.