What is GHSA-v6fq-q792-j46j?

GHSA-v6fq-q792-j46j is a security advisory published by GitHub Security Advisories with High severity. Improper Input Validation in Apache Unomi

Which CVE IDs does GHSA-v6fq-q792-j46j cover?

GHSA-v6fq-q792-j46j covers the following CVE IDs: CVE-2020-11975. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-v6fq-q792-j46j?

GHSA-v6fq-q792-j46j has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-v6fq-q792-j46j?

GHSA-v6fq-q792-j46j affects 1 product, including: maven/org.apache.unomi:unomi:\u003c 1.5.4.

GHSA-v6fq-q792-j46jHighCVSS 9.8

Improper Input Validation in Apache Unomi

Vendor

GitHub Security Advisories

Published

February 9, 2022

Last Modified

February 1, 2023

🔗 CVE IDs covered (1)

CVE-2020-11975 →

📋 Description

Apache Unomi allows conditions to use OGNL scripting which offers the possibility to call static Java classes from the JDK that could execute code with the permission level of the running Java process.

🎯 Affected products1

maven/org.apache.unomi:unomi:< 1.5.4

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2020-11975
https://lists.apache.org/thread.html/r01021bc4b25c1e98812efca0b07f0e078a6281bd52f7c3817a429d95@%3Ccommits.unomi.apache.org%3E
http://unomi.apache.org/security/cve-2020-11975.txt
https://lists.apache.org/thread.html/r79672c25e0ef9bb4b9148376281200a8e61c6d5ef5bb705e9a363460@%3Ccommits.unomi.apache.org%3E
https://github.com/advisories/GHSA-v6fq-q792-j46j