It is possible to inject malicious OGNL or MVEL scripts into the /context.json public endpoint. This was partially fixed in 1.5.1 but a new attack vector was found. In Apache Unomi version 1.5.2 scripts are now completely filtered from the input. It is highly recommended to upgrade to the latest available version of the 1.5.x release to fix this problem.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - It is possible to inject malicious OGNL or MVEL scripts into the /context.json public endpoint. This was
    partially fixed in 1.5.1 but a new attack vector was found. In Apache Unomi version 1.5.2 scripts are now
    completely filtered from the input. It is highly recommended to upgrade to the latest available version of
    the 1.5.x release to fix this problem. (CVE-2020-13942)

A remote code execution vulnerability exists in Apache Unomi due to insufficient input sanitization. An unauthenticated, remote attacker can exploit this to bypass authentication and execute arbitrary commands with the permission level of the running Java process.

ID	Name	Product	Family	Severity
420596	SCA: security update for org.apache.unomi:unomi (GHSA-xp5j-wj4h-2jq9)	Tenable Cloud Security	SCA Checks	critical
420596	SCA: security update for org.apache.unomi:unomi (GHSA-xp5j-wj4h-2jq9)	Tenable Self-Hosted Container Security	SCA Checks	critical
144969	Apache Unomi RCE (Direct Check)	Nessus	Web Servers	critical

Detections

Analytics

CVE-2020-13942

critical

Tenable Plugins

critical

critical

critical