Vulnerability in Apache Velocity Engine
CVE-2020-13936
An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache Velocity Engine versions up to 2.2.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.227 (97.7th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 98th percentile — 97.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.227 · newest: 0.227 · change: 0.000
Affected products
- Apache Velocity Engine
- Apache Wss4j — versions 2.3.1
- Apache Software Foundation Velocity Engine — versions Apache Velocity Engine
- Oracle Banking Deposits And Lines Of Credit Servicing — versions 2.12.0
- Oracle Banking Enterprise Default Management — versions 2.6.2, 2.7.1, 2.10.0
- Oracle Banking Loans Servicing — versions 2.12.0
- Oracle Banking Party Management — versions 2.7.0
- Oracle Banking Platform — versions 2.6.2, 2.7.1
- Oracle Communications Cloud Native Core Policy — versions 1.14.0
- Oracle Communications Network Integrity — versions 7.3.6
Public proof-of-concept exploits
References
- lists.apache.org/thread.html/r01043f584cbd47959fabe18fff64de940f81a65024bb8dddb… (Mailing List, Vendor Advisory)
- lists.apache.org/thread.html/rb042f3b0090e419cc9f5a3d32cf0baff283ccd6fcb1caea61… (mailing-list)
- www.openwall.com/lists/oss-security/2021/03/10/1 (mailing-list, Mailing List, Third Party Advisory)
- lists.apache.org/thread.html/r3ea4c4c908505b20a4c268330dfe7188b90c84dcf777728d0… (mailing-list)
- lists.apache.org/thread.html/rd2a89e17e8a9b451ce655f1a34117752ea1d18a22ce580d8b… (mailing-list)
- lists.debian.org/debian-lts-announce/2021/03/msg00019.html (mailing-list, Mailing List, Third Party Advisory)
- lists.apache.org/thread.html/re641197d204765130618086238c73dd2ce5a3f94b33785b58… (mailing-list)
- lists.apache.org/thread.html/rbee7270556f4172322936b5ecc9fabf0c09f00d4fa56c9de1… (mailing-list)
- lists.apache.org/thread.html/reab5978b54a9f4c078402161e30a89c42807b198814acadbe… (mailing-list)
- lists.apache.org/thread.html/rd7e865c87f9043c21d9c1fd9d4df866061d9a08cfc3227711… (mailing-list)
Frequently asked questions
- What is CVE-2020-13936?
- CVE-2020-13936 is a high-severity vulnerability in Apache Velocity Engine. CVSS score: 8.8/10. Published 2021-03-10.
- How severe is CVE-2020-13936?
- High severity. CVSS v3 base score is 8.8 out of 10.
- Is CVE-2020-13936 known to be exploited?
- 16 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.