Improper input validation in Apache Unomi
Priority HIGH 66CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.
Summary
Apache Unomi allows conditions to use OGNL scripting which offers the possibility to call static Java classes from the JDK that could execute code with the permission level of the running Java process.
Why it matters now
EPSS 0.3061 98th percentileScored 2026-11-07
Fix Fixed org.apache.unomi:unomi (Maven): 1.5.4
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Apache Unomi | Apache Unomi 1.0.0 to 1.5.0 | — | No fix listed | CNA |
| — | org.apache.unomi:unomi (Maven) | before 1.5.4 | 1.5.4 | Patch available | GHSA-v6fq-q792-j46j |
- Apache Unomi Vendor— Affected Apache Unomi 1.0.0 to 1.5.0 Fixed in — No fix listed CNA
- org.apache.unomi:unomi (Maven) Vendor— Affected before 1.5.4 Fixed in 1.5.4 Patch available GHSA-v6fq-q792-j46j
Remediation
- Fix · GHSA-v6fq-q792-j46j org.apache.unomi:unomi (Maven) Fixed in 1.5.4 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2020-11975
- 2026-10-03 Alias added: GHSA-v6fq-q792-j46j
References
Other 4
- [unomi-commits] 20201113 svn commit: r1883398 - in /unomi/website: contribute-release-guide.html documentation.html download.html index.html security/cve-2020-13942.txt
- [unomi-commits] 20210428 svn commit: r1889256 - in /unomi/website: contribute-release-guide.html documentation.html download.html index.html security/cve-2021-31164.txt
- https://lists.apache.org/thread.html/r01021bc4b25c1e98812efca0b07f0e078a6281bd52f7c3817a429d95@%3Ccommits.unomi.apache.org%3E
- https://lists.apache.org/thread.html/r79672c25e0ef9bb4b9148376281200a8e61c6d5ef5bb705e9a363460@%3Ccommits.unomi.apache.org%3E
More Apache Unomi vulnerabilities
- TI-2020-10918 Remote Code Execution in Apache Unomi CVSS 3.1CRITICAL 9.8
- TI-2021-11384 Apache Unomi log injection CVSS 3.1HIGH 7.5
Sources
- CVE-2020-11975 · CVE Program
- CVE-2020-11975 · NVD
- FIRST EPSS
- GHSA-v6fq-q792-j46j · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences