GHSA-v6fq-q792-j46j
Suggest an improvement- Source
- https://github.com/advisories/GHSA-v6fq-q792-j46j
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-v6fq-q792-j46j/GHSA-v6fq-q792-j46j.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-v6fq-q792-j46j
- Aliases
- Published
- 2022-02-09T23:20:47Z
- Modified
- 2023-11-08T04:02:08.117151Z
- Severity
-
- 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- Improper Input Validation in Apache Unomi
- Details
-
Apache Unomi allows conditions to use OGNL scripting which offers the possibility to call static Java classes from the JDK that could execute code with the permission level of the running Java process.
- Database specific
{ "nvd_published_at": "2020-06-05T15:15:00Z", "github_reviewed_at": "2021-04-14T19:36:05Z", "severity": "HIGH", "github_reviewed": true, "cwe_ids": [ "CWE-20" ] }- References
-
- https://nvd.nist.gov/vuln/detail/CVE-2020-11975
- https://lists.apache.org/thread.html/r01021bc4b25c1e98812efca0b07f0e078a6281bd52f7c3817a429d95@%3Ccommits.unomi.apache.org%3E
- https://lists.apache.org/thread.html/r79672c25e0ef9bb4b9148376281200a8e61c6d5ef5bb705e9a363460@%3Ccommits.unomi.apache.org%3E
- http://unomi.apache.org/security/cve-2020-11975.txt
Affected packages
Maven / org.apache.unomi:unomi
Package
- Name
- org.apache.unomi:unomi
- View open source insights on deps.dev
- Purl
- pkg:maven/org.apache.unomi/unomi