An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache Velocity Engine versions up to 2.2.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
History
12 May 2022, 14:34
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://www.oracle.com/security-alerts/cpuapr2022.html - Patch, Third Party Advisory | |
| CPE | cpe:2.3:a:oracle:retail_xstore_office_cloud_service:16.0.6:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_xstore_office_cloud_service:20.0.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_xstore_office_cloud_service:18.0.3:*:*:*:*:*:*:* cpe:2.3:a:oracle:hospitality_token_proxy_service:19.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_xstore_office_cloud_service:19.0.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_xstore_office_cloud_service:17.0.4:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_network_integrity:7.3.6:*:*:*:*:*:*:* |
20 Apr 2022, 00:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
31 Mar 2022, 16:52
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://www.oracle.com/security-alerts/cpujan2022.html - Patch, Third Party Advisory | |
| CPE | cpe:2.3:a:oracle:banking_platform:2.6.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.2.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_deposits_and_lines_of_credit_servicing:2.12.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.3.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_enterprise_default_management:2.10.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_enterprise_default_management:*:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_party_management:2.7.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_order_broker:16.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_loans_servicing:2.12.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_enterprise_default_management:2.7.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_enterprise_default_management:2.6.2:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_service_backbone:19.0.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.1.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_platform:*:*:*:*:*:*:*:* cpe:2.3:a:oracle:retail_integration_bus:19.0.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_platform:2.7.1:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_enterprise_default_management:2.12.0:*:*:*:*:*:*:* |
07 Feb 2022, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
23 Sep 2021, 12:21
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MLIST) https://lists.apache.org/thread.html/rf7d369de88dc88a1347006a3323b3746d849234db40a8edfd5ebc436@%3Cdev.ws.apache.org%3E - Mailing List, Vendor Advisory | |
| References | (MLIST) https://lists.apache.org/thread.html/r9dc2505651788ac668299774d9e7af4dc616be2f56fdc684d1170882@%3Cusers.activemq.apache.org%3E - Mailing List, Vendor Advisory | |
| References | (MLIST) https://lists.apache.org/thread.html/r39de20c7e9c808b1f96790875d33e58c9c0aabb44fd9227e7b3dc5da@%3Cdev.ws.apache.org%3E - Mailing List, Vendor Advisory | |
| References | (MLIST) https://lists.apache.org/thread.html/r4cd59453b65d4ac290fcb3b71fdf32b4f1f8989025e89558deb5a245@%3Cdev.ws.apache.org%3E - Mailing List, Vendor Advisory | |
| References | (MLIST) https://lists.apache.org/thread.html/r7f209b837217d2a0fe5977fb692e7f15d37fa5de8214bcdc4c21d9a7@%3Ccommits.turbine.apache.org%3E - Mailing List, Patch, Vendor Advisory | |
| References | (MLIST) https://lists.apache.org/thread.html/r17cb932fab14801b14e5b97a7f05192f4f366ef260c10d4a8dba8ac9@%3Cdev.ws.apache.org%3E - Mailing List, Vendor Advisory | |
| References | (MLIST) https://lists.apache.org/thread.html/r52a5129df402352adc34d052bab9234c8ef63596306506a89fdc7328@%3Cusers.activemq.apache.org%3E - Mailing List, Vendor Advisory | |
| References | (GENTOO) https://security.gentoo.org/glsa/202107-52 - Third Party Advisory | |
| References | (MLIST) https://lists.apache.org/thread.html/r293284c6806c73f51098001ea86a14271c39f72cd76af9e946d9d9ad@%3Cdev.ws.apache.org%3E - Mailing List, Vendor Advisory |
31 Aug 2021, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
30 Aug 2021, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Information
Published : 2021-03-10 08:15
Updated : 2024-02-04 21:23
NVD link : CVE-2020-13936
Mitre link : CVE-2020-13936
CVE.ORG link : CVE-2020-13936
JSON object : View
Products Affected
debian
- debian_linux
oracle
- communications_network_integrity
- banking_platform
- retail_order_broker
- retail_service_backbone
- retail_xstore_office_cloud_service
- utilities_testing_accelerator
- banking_loans_servicing
- banking_party_management
- retail_integration_bus
- hospitality_token_proxy_service
- communications_cloud_native_core_policy
- banking_deposits_and_lines_of_credit_servicing
- banking_enterprise_default_management
apache
- velocity_engine
- wss4j
CWE