by Kastro
Paper/Archive/CVE-2020-11975

CVE-2020-11975

apache — Apache Unomi allows conditions to use OGNL scripting which offers the possibility to call static Java classes from the JDK that could exe…

EPSS 31%CVSS 9.8
critical.is priorityof 100
49
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 98.2.982 × 2019.6No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Apache Unomi allows conditions to use OGNL scripting which offers the possibility to call static Java classes from the JDK that could execute code with the permission level of the running Java process.

Affected

ProductAffectedFixed inSource
Apache UnomiApache Unomi 1.0.0 to 1.5.0–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refunomi.apache.org/security/cve-2020-11975.txtreflists.apache.org/thread.html/r01021bc4b25c1e98812efca0b07f0e078a6281bd52f7c3817a429d95%40%3Ccommits.unomi.apache.org%3Ereflists.apache.org/thread.html/r79672c25e0ef9bb4b9148376281200a8e61c6d5ef5bb705e9a363460%40%3Ccommits.unomi.apache.org%3E