Apache Unomi
3 CVEs affecting Apache Unomi. Latest disclosed: 2021-05-04. Critical: 2, High: 1.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-13942 | Critical | 9.8 | 2020-11-24 | It is possible to inject malicious OGNL or MVEL scripts into the /context.json public endpoint. This was partially fixed in 1.5.1 but a new attack vector was f… |
CVE-2020-11975 | Critical | 9.8 | 2020-06-05 | Apache Unomi allows conditions to use OGNL scripting which offers the possibility to call static Java classes from the JDK that could execute code with the per… |
CVE-2021-31164 | High | 7.5 | 2021-05-04 | Apache Unomi prior to version 1.5.5 allows CRLF log injection because of the lack of escaping in the log statements. |