Remote Code Execution in Apache Unomi
72Vexday Risk Score
Corrija agora. Ela exploração observada pelo VulnCheck e tem exploit funcional público.
ssvc Actepss 68%
da publicação à arma0 dias
Publicada no NVD24 de nov.
1ª PoC20 de nov.
VulnCheck+139d
probabilidade de exploração
68%top 1% das CVEs
exploração observada
simVulnCheck
6 exploit(s) público(s)
It is possible to inject malicious OGNL or MVEL scripts into the /context.json public endpoint. This was partially fixed in 1.5.1 but a new attack vector was found. In Apache Unomi version 1.5.2 scripts are now completely filtered from the input. It is highly recommended to upgrade to the latest available version of the 1.5.x release to fix this problem.
Produtos afetados
Apache Software Foundation · Apache UnomiPoCs públicas encontradas — 6
vulncheckvulncheck.com/xdb/05247f160481não verificadovulncheckvulncheck.com/xdb/465a48e5ddd5não verificadovulncheckvulncheck.com/xdb/ff091b790f50não verificadovulncheckvulncheck.com/xdb/1ac7e5a40dd2não verificadovulncheckvulncheck.com/xdb/66d89e00d424não verificadovulncheckvulncheck.com/xdb/2aaece82354enão verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
Referências
https://advisory.checkmarx.net/advisory/CX-2020-4284https://lists.apache.org/thread.html/r08a4057ff7196b8880117edaa4b6207cbd36ed692d8dd1f5a56b4d0f%40%3Cannounce.apache.org%3Ehttps://lists.apache.org/thread.html/r4a8fa91836687eaca42b5420a778ca8c8fd3a3740e4cf4401acc9118%40%3Cdev.unomi.apache.org%3Ehttps://lists.apache.org/thread.html/r4a8fa91836687eaca42b5420a778ca8c8fd3a3740e4cf4401acc9118%40%3Cusers.unomi.apache.org%3Ehttps://lists.apache.org/thread.html/r79672c25e0ef9bb4b9148376281200a8e61c6d5ef5bb705e9a363460%40%3Ccommits.unomi.apache.org%3Ehttps://lists.apache.org/thread.html/rcb6d2eafcf15def433aaddfa06738e5faa5060cef2647769e178999a%40%3Cdev.unomi.apache.org%3Ehttps://lists.apache.org/thread.html/rcb6d2eafcf15def433aaddfa06738e5faa5060cef2647769e178999a%40%3Cusers.unomi.apache.org%3Ehttp://unomi.apache.org./security/cve-2020-13942.txthttp://www.openwall.com/lists/oss-security/2020/11/24/5