Vulnerability-Lookup

CNVD-2021-11849

Vulnerability from cnvd - Published: 2021-02-23

Title

Apache Unomi远程代码执行漏洞

Description

Apache Unomi是一个可用于多系统的java开源客户数据平台，用于管理用户配置文件和与该配置文件相关的数据，Unomi在2019年被宣布成为Apache的顶级项目。由于Apache Unomi是作为运行在Apache Karaf中的OSGi应用程序构建的，因此它具有极好的可扩展性和易用性。 Apache Unomi在1.5.2之前版本中存在远程代码执行漏洞。该平台具有内置的规则系统和用户细分的概念，当用户需要为配置文件下发数据时，可以使用OGNL或MVEL类的表达式语言未受限制的执行查询操作，从而导致了Unomi容易受到表达式注入攻击，攻击者可以利用该漏洞发送符合语法的恶意表达式使Unomi服务器执行任意代码和系统命令。

Severity

高

Patch Name

Apache Unomi远程代码执行漏洞的补丁

Patch Description

Formal description

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： http://unomi.apache.org./security/cve-2020-13942.txt

Reference

https://nvd.nist.gov/vuln/detail/CVE-2020-13942

Impacted products

Name
Apache Apache Unomi <1.5.2

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2020-13942",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2020-13942"
    }
  },
  "description": "Apache Unomi\u662f\u4e00\u4e2a\u53ef\u7528\u4e8e\u591a\u7cfb\u7edf\u7684java\u5f00\u6e90\u5ba2\u6237\u6570\u636e\u5e73\u53f0\uff0c\u7528\u4e8e\u7ba1\u7406\u7528\u6237\u914d\u7f6e\u6587\u4ef6\u548c\u4e0e\u8be5\u914d\u7f6e\u6587\u4ef6\u76f8\u5173\u7684\u6570\u636e\uff0cUnomi\u57282019\u5e74\u88ab\u5ba3\u5e03\u6210\u4e3aApache\u7684\u9876\u7ea7\u9879\u76ee\u3002\u7531\u4e8eApache Unomi\u662f\u4f5c\u4e3a\u8fd0\u884c\u5728Apache Karaf\u4e2d\u7684OSGi\u5e94\u7528\u7a0b\u5e8f\u6784\u5efa\u7684\uff0c\u56e0\u6b64\u5b83\u5177\u6709\u6781\u597d\u7684\u53ef\u6269\u5c55\u6027\u548c\u6613\u7528\u6027\u3002\n\nApache Unomi\u57281.5.2\u4e4b\u524d\u7248\u672c\u4e2d\u5b58\u5728\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\u3002\u8be5\u5e73\u53f0\u5177\u6709\u5185\u7f6e\u7684\u89c4\u5219\u7cfb\u7edf\u548c\u7528\u6237\u7ec6\u5206\u7684\u6982\u5ff5\uff0c\u5f53\u7528\u6237\u9700\u8981\u4e3a\u914d\u7f6e\u6587\u4ef6\u4e0b\u53d1\u6570\u636e\u65f6\uff0c\u53ef\u4ee5\u4f7f\u7528OGNL\u6216MVEL\u7c7b\u7684\u8868\u8fbe\u5f0f\u8bed\u8a00\u672a\u53d7\u9650\u5236\u7684\u6267\u884c\u67e5\u8be2\u64cd\u4f5c\uff0c\u4ece\u800c\u5bfc\u81f4\u4e86Unomi\u5bb9\u6613\u53d7\u5230\u8868\u8fbe\u5f0f\u6ce8\u5165\u653b\u51fb\uff0c\u653b\u51fb\u8005\u53ef\u4ee5\u5229\u7528\u8be5\u6f0f\u6d1e\u53d1\u9001\u7b26\u5408\u8bed\u6cd5\u7684\u6076\u610f\u8868\u8fbe\u5f0f\u4f7fUnomi\u670d\u52a1\u5668\u6267\u884c\u4efb\u610f\u4ee3\u7801\u548c\u7cfb\u7edf\u547d\u4ee4\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttp://unomi.apache.org./security/cve-2020-13942.txt",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2021-11849",
  "openTime": "2021-02-23",
  "patchDescription": "Apache Unomi\u662f\u4e00\u4e2a\u53ef\u7528\u4e8e\u591a\u7cfb\u7edf\u7684java\u5f00\u6e90\u5ba2\u6237\u6570\u636e\u5e73\u53f0\uff0c\u7528\u4e8e\u7ba1\u7406\u7528\u6237\u914d\u7f6e\u6587\u4ef6\u548c\u4e0e\u8be5\u914d\u7f6e\u6587\u4ef6\u76f8\u5173\u7684\u6570\u636e\uff0cUnomi\u57282019\u5e74\u88ab\u5ba3\u5e03\u6210\u4e3aApache\u7684\u9876\u7ea7\u9879\u76ee\u3002\u7531\u4e8eApache Unomi\u662f\u4f5c\u4e3a\u8fd0\u884c\u5728Apache Karaf\u4e2d\u7684OSGi\u5e94\u7528\u7a0b\u5e8f\u6784\u5efa\u7684\uff0c\u56e0\u6b64\u5b83\u5177\u6709\u6781\u597d\u7684\u53ef\u6269\u5c55\u6027\u548c\u6613\u7528\u6027\u3002\r\n\r\nApache Unomi\u57281.5.2\u4e4b\u524d\u7248\u672c\u4e2d\u5b58\u5728\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\u3002\u8be5\u5e73\u53f0\u5177\u6709\u5185\u7f6e\u7684\u89c4\u5219\u7cfb\u7edf\u548c\u7528\u6237\u7ec6\u5206\u7684\u6982\u5ff5\uff0c\u5f53\u7528\u6237\u9700\u8981\u4e3a\u914d\u7f6e\u6587\u4ef6\u4e0b\u53d1\u6570\u636e\u65f6\uff0c\u53ef\u4ee5\u4f7f\u7528OGNL\u6216MVEL\u7c7b\u7684\u8868\u8fbe\u5f0f\u8bed\u8a00\u672a\u53d7\u9650\u5236\u7684\u6267\u884c\u67e5\u8be2\u64cd\u4f5c\uff0c\u4ece\u800c\u5bfc\u81f4\u4e86Unomi\u5bb9\u6613\u53d7\u5230\u8868\u8fbe\u5f0f\u6ce8\u5165\u653b\u51fb\uff0c\u653b\u51fb\u8005\u53ef\u4ee5\u5229\u7528\u8be5\u6f0f\u6d1e\u53d1\u9001\u7b26\u5408\u8bed\u6cd5\u7684\u6076\u610f\u8868\u8fbe\u5f0f\u4f7fUnomi\u670d\u52a1\u5668\u6267\u884c\u4efb\u610f\u4ee3\u7801\u548c\u7cfb\u7edf\u547d\u4ee4\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Apache Unomi\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "Apache Apache Unomi \u003c1.5.2"
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2020-13942",
  "serverity": "\u9ad8",
  "submitTime": "2020-11-23",
  "title": "Apache Unomi\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e"
}

CVE-2020-13942 (GCVE-0-2020-13942)

Vulnerability from cvelistv5 – Published: 2020-11-24 18:00 – Updated: 2025-02-13 16:27

Title

Remote Code Execution in Apache Unomi

Summary

It is possible to inject malicious OGNL or MVEL scripts into the /context.json public endpoint. This was partially fixed in 1.5.1 but a new attack vector was found. In Apache Unomi version 1.5.2 scripts are now completely filtered from the input. It is highly recommended to upgrade to the latest available version of the 1.5.x release to fix this problem.

Severity

No CVSS data available.

CWE

CWE-20 - Improper Input Validation

Assigner

apache CNA under the mitre root

CNA scorecard B 76/100 over 1112 records in the last 180 days details

References

9 references

URL	Tags
http://unomi.apache.org./security/cve-2020-13942.txt	x_refsource_MISC
https://lists.apache.org/thread.html/rcb6d2eafcf1…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/rcb6d2eafcf1…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/r4a8fa918366…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/r4a8fa918366…	mailing-listx_refsource_MLIST
http://www.openwall.com/lists/oss-security/2020/11/24/5	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/r08a4057ff71…	mailing-listx_refsource_MLIST
https://advisory.checkmarx.net/advisory/CX-2020-4284	x_refsource_MISC
https://lists.apache.org/thread.html/r79672c25e0e…	mailing-listx_refsource_MLIST

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache Unomi	Affected: unspecified , < 1.5.2 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T12:32:14.603Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://unomi.apache.org./security/cve-2020-13942.txt"
          },
          {
            "name": "[unomi-dev] 20201124 CVE-2020-13942: Remote Code Execution in Apache Unomi",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rcb6d2eafcf15def433aaddfa06738e5faa5060cef2647769e178999a%40%3Cdev.unomi.apache.org%3E"
          },
          {
            "name": "[unomi-users] 20201124 CVE-2020-13942: Remote Code Execution in Apache Unomi",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rcb6d2eafcf15def433aaddfa06738e5faa5060cef2647769e178999a%40%3Cusers.unomi.apache.org%3E"
          },
          {
            "name": "[unomi-users] 20201124 Apache Unomi 1.5.4 Release",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r4a8fa91836687eaca42b5420a778ca8c8fd3a3740e4cf4401acc9118%40%3Cusers.unomi.apache.org%3E"
          },
          {
            "name": "[unomi-dev] 20201124 Apache Unomi 1.5.4 Release",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r4a8fa91836687eaca42b5420a778ca8c8fd3a3740e4cf4401acc9118%40%3Cdev.unomi.apache.org%3E"
          },
          {
            "name": "[oss-security] 20201124 CVE-2020-13942: Remote Code Execution in Apache Unomi",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2020/11/24/5"
          },
          {
            "name": "[announce] 20201124 CVE-2020-13942: Remote Code Execution in Apache Unomi",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r08a4057ff7196b8880117edaa4b6207cbd36ed692d8dd1f5a56b4d0f%40%3Cannounce.apache.org%3E"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://advisory.checkmarx.net/advisory/CX-2020-4284"
          },
          {
            "name": "[unomi-commits] 20210428 svn commit: r1889256 - in /unomi/website: contribute-release-guide.html documentation.html download.html index.html security/cve-2021-31164.txt",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r79672c25e0ef9bb4b9148376281200a8e61c6d5ef5bb705e9a363460%40%3Ccommits.unomi.apache.org%3E"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Apache Unomi",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "1.5.2",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "It is possible to inject malicious OGNL or MVEL scripts into the /context.json public endpoint. This was partially fixed in 1.5.1 but a new attack vector was found. In Apache Unomi version 1.5.2 scripts are now completely filtered from the input. It is highly recommended to upgrade to the latest available version of the 1.5.x release to fix this problem."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-08-04T12:34:05.000Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://unomi.apache.org./security/cve-2020-13942.txt"
        },
        {
          "name": "[unomi-dev] 20201124 CVE-2020-13942: Remote Code Execution in Apache Unomi",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rcb6d2eafcf15def433aaddfa06738e5faa5060cef2647769e178999a%40%3Cdev.unomi.apache.org%3E"
        },
        {
          "name": "[unomi-users] 20201124 CVE-2020-13942: Remote Code Execution in Apache Unomi",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rcb6d2eafcf15def433aaddfa06738e5faa5060cef2647769e178999a%40%3Cusers.unomi.apache.org%3E"
        },
        {
          "name": "[unomi-users] 20201124 Apache Unomi 1.5.4 Release",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r4a8fa91836687eaca42b5420a778ca8c8fd3a3740e4cf4401acc9118%40%3Cusers.unomi.apache.org%3E"
        },
        {
          "name": "[unomi-dev] 20201124 Apache Unomi 1.5.4 Release",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r4a8fa91836687eaca42b5420a778ca8c8fd3a3740e4cf4401acc9118%40%3Cdev.unomi.apache.org%3E"
        },
        {
          "name": "[oss-security] 20201124 CVE-2020-13942: Remote Code Execution in Apache Unomi",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2020/11/24/5"
        },
        {
          "name": "[announce] 20201124 CVE-2020-13942: Remote Code Execution in Apache Unomi",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r08a4057ff7196b8880117edaa4b6207cbd36ed692d8dd1f5a56b4d0f%40%3Cannounce.apache.org%3E"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://advisory.checkmarx.net/advisory/CX-2020-4284"
        },
        {
          "name": "[unomi-commits] 20210428 svn commit: r1889256 - in /unomi/website: contribute-release-guide.html documentation.html download.html index.html security/cve-2021-31164.txt",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r79672c25e0ef9bb4b9148376281200a8e61c6d5ef5bb705e9a363460%40%3Ccommits.unomi.apache.org%3E"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Remote Code Execution in Apache Unomi",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@apache.org",
          "ID": "CVE-2020-13942",
          "STATE": "PUBLIC",
          "TITLE": "Remote Code Execution in Apache Unomi"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Apache Unomi",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "1.5.2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Apache Software Foundation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "It is possible to inject malicious OGNL or MVEL scripts into the /context.json public endpoint. This was partially fixed in 1.5.1 but a new attack vector was found. In Apache Unomi version 1.5.2 scripts are now completely filtered from the input. It is highly recommended to upgrade to the latest available version of the 1.5.x release to fix this problem."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-20 Improper Input Validation"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://unomi.apache.org./security/cve-2020-13942.txt",
              "refsource": "MISC",
              "url": "http://unomi.apache.org./security/cve-2020-13942.txt"
            },
            {
              "name": "[unomi-dev] 20201124 CVE-2020-13942: Remote Code Execution in Apache Unomi",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rcb6d2eafcf15def433aaddfa06738e5faa5060cef2647769e178999a@%3Cdev.unomi.apache.org%3E"
            },
            {
              "name": "[unomi-users] 20201124 CVE-2020-13942: Remote Code Execution in Apache Unomi",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rcb6d2eafcf15def433aaddfa06738e5faa5060cef2647769e178999a@%3Cusers.unomi.apache.org%3E"
            },
            {
              "name": "[unomi-users] 20201124 Apache Unomi 1.5.4 Release",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r4a8fa91836687eaca42b5420a778ca8c8fd3a3740e4cf4401acc9118@%3Cusers.unomi.apache.org%3E"
            },
            {
              "name": "[unomi-dev] 20201124 Apache Unomi 1.5.4 Release",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r4a8fa91836687eaca42b5420a778ca8c8fd3a3740e4cf4401acc9118@%3Cdev.unomi.apache.org%3E"
            },
            {
              "name": "[oss-security] 20201124 CVE-2020-13942: Remote Code Execution in Apache Unomi",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2020/11/24/5"
            },
            {
              "name": "[announce] 20201124 CVE-2020-13942: Remote Code Execution in Apache Unomi",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r08a4057ff7196b8880117edaa4b6207cbd36ed692d8dd1f5a56b4d0f@%3Cannounce.apache.org%3E"
            },
            {
              "name": "https://advisory.checkmarx.net/advisory/CX-2020-4284",
              "refsource": "MISC",
              "url": "https://advisory.checkmarx.net/advisory/CX-2020-4284"
            },
            {
              "name": "[unomi-commits] 20210428 svn commit: r1889256 - in /unomi/website: contribute-release-guide.html documentation.html download.html index.html security/cve-2021-31164.txt",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r79672c25e0ef9bb4b9148376281200a8e61c6d5ef5bb705e9a363460@%3Ccommits.unomi.apache.org%3E"
            }
          ]
        },
        "source": {
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2020-13942",
    "datePublished": "2020-11-24T18:00:16.000Z",
    "dateReserved": "2020-06-08T00:00:00.000Z",
    "dateUpdated": "2025-02-13T16:27:30.019Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted