Skip to content
Sign in Sign up
JA EN FR
SecPulse
Unrated

It is possible to inject malicious OGNL or MVEL scripts into the /context.json public endpoint. This was partially fixed in 1.5.1 but a new attack vec...

CVE-2020-13942 First seen on SecPulse
Original description The description as published by the source.

It is possible to inject malicious OGNL or MVEL scripts into the /context.json public endpoint. This was partially fixed in 1.5.1 but a new attack vector was found. In Apache Unomi version 1.5.2 scripts are now completely filtered from the input. It is highly recommended to upgrade to the latest available version of the 1.5.x release to fix this problem.

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

References

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details