GHSA-v6fq-q792-j46j

Improper Input Validation in Apache Unomi

Source: GitHub Advisory Database (reviewed) High CVE-2020-11975

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.apache.unomi:unomi	< 1.5.4	1.5.4

Details

As written in the advisory (Markdown source, shown as plain text).

Apache Unomi allows conditions to use OGNL scripting which offers the possibility to call static Java classes from the JDK that could execute code with the permission level of the running Java process.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-11975 advisory
https://lists.apache.org/thread.html/r01021bc4b25c1e98812efca0b07f0e078a6281bd52f7c3817a429d95@%3Ccommits.unomi.apache.org%3E web
https://lists.apache.org/thread.html/r79672c25e0ef9bb4b9148376281200a8e61c6d5ef5bb705e9a363460@%3Ccommits.unomi.apache.org%3E web
http://unomi.apache.org/security/cve-2020-11975.txt web