CVE-2020-11975

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2020-11975

Import Source

https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-11975.json

JSON Data

https://api.test.osv.dev/v1/vulns/CVE-2020-11975

Aliases

GHSA-v6fq-q792-j46j

Published

2020-06-05T15:15:10.723Z

Modified

2026-03-13T22:36:08.496356Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

Apache Unomi allows conditions to use OGNL scripting which offers the possibility to call static Java classes from the JDK that could execute code with the permission level of the running Java process.

References

Affected packages

Git / github.com/apache/unomi

Affected ranges

Type

GIT

Repo

https://github.com/apache/unomi

Events

Introduced

Fixed

75c6cf56f1917a9cc5bd157c5e99c0e228cffcfc

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.5.1"
        }
    ]
}

Affected versions

unomi-root-1.*

unomi-root-1.0.0-incubating

unomi-root-1.1.0-incubating

unomi-root-1.2.0-incubating

unomi-root-1.4.0

unomi-root-1.5.0

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-11975.json"