Velocity Sandbox Bypass
Priority MEDIUM 58CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 14 fixed, 16 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache Velocity Engine versions up to 2.2.
Why it matters now
EPSS 0.22709 97th percentileScored 2026-11-07
Fix Partial org.apache.velocity:velocity-engine-parent (Maven): 2.3Red Hat: 14 advisoriesRed Hat: 14 fixed, 16 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Velocity Engine | Apache Velocity Engine – 2.2 | — | No fix listed | CNA |
| — | org.apache.velocity:velocity-engine-parent (Maven) | before 2.3 | 2.3 | Patch available | GHSA-59j4-wjwp-mw9m |
| — | org.apache.velocity:velocity (Maven) | up to 1.7 | — | No fix listed | GHSA-59j4-wjwp-mw9m |
- Apache Velocity Engine VendorApache Affected Apache Velocity Engine – 2.2 Fixed in — No fix listed CNA
- org.apache.velocity:velocity-engine-parent (Maven) Vendor— Affected before 2.3 Fixed in 2.3 Patch available GHSA-59j4-wjwp-mw9m
- org.apache.velocity:velocity (Maven) Vendor— Affected up to 1.7 Fixed in — No fix listed GHSA-59j4-wjwp-mw9m
CPE configurations NVD · 28
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:velocity_engine:*:*:*:*:*:*:*:* | before 2.3 | Vulnerable | Apache |
| cpe:2.3:a:apache:wss4j:2.3.1:*:*:*:*:*:*:* | 2.3.1 | Vulnerable | Apache |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:a:oracle:banking_deposits_and_lines_of_credit_servicing:2.12.0:*:*:*:*:*:*:* | 2.12.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_enterprise_default_management:*:*:*:*:*:*:*:* | 2.3.0 – 2.4.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_enterprise_default_management:2.6.2:*:*:*:*:*:*:* | 2.6.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_enterprise_default_management:2.7.1:*:*:*:*:*:*:* | 2.7.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_enterprise_default_management:2.10.0:*:*:*:*:*:*:* | 2.10.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_enterprise_default_management:2.12.0:*:*:*:*:*:*:* | 2.12.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_loans_servicing:2.12.0:*:*:*:*:*:*:* | 2.12.0 | Vulnerable | Oracle |
- cpe:2.3:a:apache:velocity_engine:*:*:*:*:*:*:*:* Versions before 2.3 Vulnerable ·Apache
- cpe:2.3:a:apache:wss4j:2.3.1:*:*:*:*:*:*:* Versions 2.3.1 Vulnerable ·Apache
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:a:oracle:banking_deposits_and_lines_of_credit_servicing:2.12.0:*:*:*:*:*:*:* Versions 2.12.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_enterprise_default_management:*:*:*:*:*:*:*:* Versions 2.3.0 – 2.4.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_enterprise_default_management:2.6.2:*:*:*:*:*:*:* Versions 2.6.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_enterprise_default_management:2.7.1:*:*:*:*:*:*:* Versions 2.7.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_enterprise_default_management:2.10.0:*:*:*:*:*:*:* Versions 2.10.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_enterprise_default_management:2.12.0:*:*:*:*:*:*:* Versions 2.12.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_loans_servicing:2.12.0:*:*:*:*:*:*:* Versions 2.12.0 Vulnerable ·Oracle
Show 18 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:oracle:banking_party_management:2.7.0:*:*:*:*:*:*:* | 2.7.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_platform:*:*:*:*:*:*:*:* | 2.3.0 – 2.4.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_platform:2.6.2:*:*:*:*:*:*:* | 2.6.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_platform:2.7.1:*:*:*:*:*:*:* | 2.7.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:* | 1.14.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_network_integrity:7.3.6:*:*:*:*:*:*:* | 7.3.6 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:hospitality_token_proxy_service:19.2:*:*:*:*:*:*:* | 19.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_integration_bus:19.0.1:*:*:*:*:*:*:* | 19.0.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_order_broker:16.0:*:*:*:*:*:*:* | 16.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_service_backbone:19.0.1:*:*:*:*:*:*:* | 19.0.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_xstore_office_cloud_service:16.0.6:*:*:*:*:*:*:* | 16.0.6 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_xstore_office_cloud_service:17.0.4:*:*:*:*:*:*:* | 17.0.4 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_xstore_office_cloud_service:18.0.3:*:*:*:*:*:*:* | 18.0.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_xstore_office_cloud_service:19.0.2:*:*:*:*:*:*:* | 19.0.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_xstore_office_cloud_service:20.0.1:*:*:*:*:*:*:* | 20.0.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.1.1:*:*:*:*:*:*:* | 6.0.0.1.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.2.2:*:*:*:*:*:*:* | 6.0.0.2.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.3.1:*:*:*:*:*:*:* | 6.0.0.3.1 | Vulnerable | Oracle |
- cpe:2.3:a:oracle:banking_party_management:2.7.0:*:*:*:*:*:*:* Versions 2.7.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_platform:*:*:*:*:*:*:*:* Versions 2.3.0 – 2.4.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_platform:2.6.2:*:*:*:*:*:*:* Versions 2.6.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_platform:2.7.1:*:*:*:*:*:*:* Versions 2.7.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:* Versions 1.14.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_network_integrity:7.3.6:*:*:*:*:*:*:* Versions 7.3.6 Vulnerable ·Oracle
- cpe:2.3:a:oracle:hospitality_token_proxy_service:19.2:*:*:*:*:*:*:* Versions 19.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_integration_bus:19.0.1:*:*:*:*:*:*:* Versions 19.0.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_order_broker:16.0:*:*:*:*:*:*:* Versions 16.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_service_backbone:19.0.1:*:*:*:*:*:*:* Versions 19.0.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_xstore_office_cloud_service:16.0.6:*:*:*:*:*:*:* Versions 16.0.6 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_xstore_office_cloud_service:17.0.4:*:*:*:*:*:*:* Versions 17.0.4 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_xstore_office_cloud_service:18.0.3:*:*:*:*:*:*:* Versions 18.0.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_xstore_office_cloud_service:19.0.2:*:*:*:*:*:*:* Versions 19.0.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_xstore_office_cloud_service:20.0.1:*:*:*:*:*:*:* Versions 20.0.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.1.1:*:*:*:*:*:*:* Versions 6.0.0.1.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.2.2:*:*:*:*:*:*:* Versions 6.0.0.2.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.3.1:*:*:*:*:*:*:* Versions 6.0.0.3.1 Vulnerable ·Oracle
Remediation
- Fix · GHSA-59j4-wjwp-mw9m org.apache.velocity:velocity-engine-parent (Maven) Fixed in 2.3 Advisory →
Red Hat 14 advisories
- RHSA-2025:1747 Released 2025-02-24 · Red Hat rating CriticalRed Hat JBoss Enterprise Application Platform 7.3.12 security update
- Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-hal-console-3.2.17-1.Final_redhat_00001.1.el7eap, eap7-jackson-annotations-2.10.4-2.redhat_00004.1.el7eap, eap7-jackson-core-2.10.4-2.redhat_00004.1.el7eap +38
- RHSA-2025:1746 Released 2025-02-24 · Red Hat rating CriticalRed Hat JBoss Enterprise Application Platform 7.1.9 on RHEL 7 security update
- Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-apache-cxf-3.1.16-4.redhat_00003.1.ep7.el7, eap7-apache-cxf-rt-3.1.16-4.redhat_00003.1.ep7.el7, eap7-apache-cxf-services-3.1.16-4.redhat_00003.1.ep7.el7 +26
- RHSA-2021:4918 Released 2021-12-02 · Red Hat rating ModerateRed Hat Integration Camel-K 1.6 release and security update
- Red Hat Integration
Show 11 more Red Hat advisories
- RHSA-2021:4767 Released 2021-11-23 · Red Hat rating ModerateRed Hat Integration Camel Extensions for Quarkus GA security update
- Red Hat Integration Camel Quarkus 2
- RHSA-2021:3660 Released 2021-09-23 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.1 security update
- Red Hat JBoss Enterprise Application Platform commons-io.commons-io-2.10.0.redhat-00001.jar, io.netty.netty-all-4.1.63.Final-redhat-00001.jar, io.undertow.undertow-core-2.2.9.SP1-redhat-00001.jar +5
- RHSA-2021:3658 Released 2021-09-23 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.1 security update on RHEL 8
- Red Hat JBoss EAP 7.4 for RHEL 8 eap7-apache-commons-io-2.10.0-1.redhat_00001.1.el8eap, eap7-jakarta-el-3.0.3-2.redhat_00006.1.el8eap, eap7-netty-4.1.63-1.Final_redhat_00001.1.el8eap +9
- RHSA-2021:3656 Released 2021-09-23 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.1 security update on RHEL 7
- Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-apache-commons-io-2.10.0-1.redhat_00001.1.el7eap, eap7-jakarta-el-3.0.3-2.redhat_00006.1.el7eap, eap7-netty-4.1.63-1.Final_redhat_00001.1.el7eap +11
- RHSA-2021:3140 Released 2021-08-11 · Red Hat rating ModerateRed Hat Fuse 7.9.0 release and security update
- Red Hat Fuse 7.9
- RHSA-2021:2755 Released 2021-07-15 · Red Hat rating ModerateEAP XP 2 security update to CVE fixes in the EAP 7.3.x base
- Red Hat EAP-XP 2.0.0 via EAP 7.3.x base
- RHSA-2021:2210 Released 2021-06-02 · Red Hat rating ModerateEAP XP 1 security update to CVE fixes in the EAP 7.3.x base
- Red Hat EAP-XP via EAP 7.3.x base
- RHSA-2021:2048 Released 2021-05-19 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 7.3.7 security update on RHEL 8
- Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-artemis-wildfly-integration-1.0.4-1.redhat_00001.1.el8eap, eap7-bouncycastle-1.68.0-2.redhat_00005.1.el8eap, eap7-bouncycastle-mail-1.68.0-2.redhat_00005.1.el8eap +47
- RHSA-2021:2046 Released 2021-05-19 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 7.3.7 security update on RHEL 6
- Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-artemis-wildfly-integration-1.0.4-1.redhat_00001.1.el6eap, eap7-bouncycastle-1.68.0-2.redhat_00005.1.el6eap, eap7-bouncycastle-mail-1.68.0-2.redhat_00005.1.el6eap +47
- RHSA-2021:2047 Released 2021-05-19 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 7.3.7 security update on RHEL 7
- Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-artemis-wildfly-integration-1.0.4-1.redhat_00001.1.el7eap, eap7-bouncycastle-1.68.0-2.redhat_00005.1.el7eap, eap7-bouncycastle-mail-1.68.0-2.redhat_00005.1.el7eap +47
- RHSA-2021:2051 Released 2021-05-19 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 7.3.7 security update
- Red Hat JBoss Enterprise Application Platform 7
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat BPM Suite 6 | Affected | No fix planned: Out of support scope |
| Red Hat Decision Manager 7 | Affected | No fix yet |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Integration Camel Quarkus 1 | Affected | No fix yet |
| Red Hat JBoss A-MQ 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss BRMS 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Data Virtualization 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Affected | No fix yet |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Operations Network 3 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 3.11 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 4 | Affected | No fix planned: Will not fix |
| Red Hat Process Automation 7 | Affected | No fix yet |
| Red Hat EAP-XP 2.0.0 via EAP 7.3.x base | Fixed | RHSA-2021:2755 |
| Red Hat EAP-XP via EAP 7.3.x base | Fixed | RHSA-2021:2210 |
| Red Hat Fuse 7.9 | Fixed | RHSA-2021:3140 |
| Red Hat Integration | Fixed | RHSA-2021:4918 |
| Red Hat Integration Camel Quarkus 2 | Fixed | RHSA-2021:4767 |
| Red Hat JBoss EAP 7.3 for BaseOS-8 | Fixed | RHSA-2021:2048 |
| Red Hat JBoss EAP 7.3 for RHEL 6 Server | Fixed | RHSA-2021:2046 |
| Red Hat JBoss EAP 7.3 for RHEL 7 Server | Fixed | RHSA-2021:2047 |
| Red Hat JBoss EAP 7.4 for RHEL 7 Server | Fixed | RHSA-2021:3656 |
| Red Hat JBoss EAP 7.4 for RHEL 8 | Fixed | RHSA-2021:3658 |
| Red Hat JBoss Enterprise Application Platform | Fixed | RHSA-2021:3660 |
| Red Hat JBoss Enterprise Application Platform 7 | Fixed | RHSA-2021:2051 |
| Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server | Fixed | RHSA-2025:1746 |
| Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server | Fixed | RHSA-2025:1747 |
Not affected: 7 products
- A-MQ Clients 2
- Red Hat AMQ Broker 7
- Red Hat Enterprise Linux 6
- Red Hat JBoss EAP 7.4 for RHEL 7 Server
- Red Hat JBoss EAP 7.4 for RHEL 8
- Red Hat JBoss Enterprise Application Platform
- Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server
Timeline
- 2026-10-02 Threatist record created from CVE-2020-13936
- 2026-10-03 Alias added: GHSA-59j4-wjwp-mw9m
References
Patch 2
Advisory 5
- https://lists.apache.org/thread.html/r01043f584cbd47959fabe18fff64de940f81a65024bb8dddbda31d9a%40%3Cuser.velocity.apache.org%3E
- [oss-security] 20210309 CVE-2020-13936: Velocity Sandbox Bypass
- [debian-lts-announce] 20210317 [SECURITY] [DLA 2595-1] velocity security update
- GLSA-202107-52
- https://nvd.nist.gov/vuln/detail/CVE-2020-13936
Other 36
- [velocity-commits] 20210310 [velocity-site] 01/01: CVE announcement
- [announce] 20210310 CVE-2020-13936: Velocity Sandbox Bypass
- [druid-commits] 20210316 [GitHub] [druid] clintropolis opened a new pull request #11002: suppress CVE check for security fix
- [ws-dev] 20210318 [jira] [Commented] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936)
- [ws-dev] 20210318 [jira] [Created] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936)
- [ws-dev] 20210319 [jira] [Commented] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936)
- [ws-dev] 20210319 [jira] [Comment Edited] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936)
- [ws-dev] 20210322 [jira] [Commented] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936)
- [santuario-dev] 20210323 [GitHub] [santuario-xml-security-java] dependabot[bot] opened a new pull request #33: Bump dependency-check-maven from 6.1.2 to 6.1.3
- [ws-dev] 20210324 [jira] [Commented] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936)
- [ws-dev] 20210325 [jira] [Updated] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936)
- [ws-dev] 20210325 [jira] [Commented] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936)
- [turbine-commits] 20210329 svn commit: r1888167 - /turbine/core/trunk/pom.xml
- [ws-dev] 20210331 [jira] [Commented] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936)
- [ws-dev] 20210401 [jira] [Commented] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936)
- [activemq-users] 20210830 Security issues
- [activemq-users] 20210831 RE: Security issues
- https://lists.apache.org/thread.html/rf7d369de88dc88a1347006a3323b3746d849234db40a8edfd5ebc436@%3Cdev.ws.apache.org%3E
- https://lists.apache.org/thread.html/reab5978b54a9f4c078402161e30a89c42807b198814acadbe6c862c7@%3Cdev.ws.apache.org%3E
- https://lists.apache.org/thread.html/re8e7482fe54d289fc0229e61cc64947b63b12c3c312e9f25bf6f3b8c@%3Cdev.ws.apache.org%3E
- https://lists.apache.org/thread.html/re641197d204765130618086238c73dd2ce5a3f94b33785b587d72726@%3Cdev.ws.apache.org%3E
- https://lists.apache.org/thread.html/rd7e865c87f9043c21d9c1fd9d4df866061d9a08cfc322771160d8058@%3Cdev.ws.apache.org%3E
- https://lists.apache.org/thread.html/rd2a89e17e8a9b451ce655f1a34117752ea1d18a22ce580d8baa824fd@%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/rbee7270556f4172322936b5ecc9fabf0c09f00d4fa56c9de1963c340@%3Cdev.ws.apache.org%3E
- https://lists.apache.org/thread.html/rb042f3b0090e419cc9f5a3d32cf0baff283ccd6fcb1caea61915d6b6@%3Ccommits.velocity.apache.org%3E
- https://lists.apache.org/thread.html/r9dc2505651788ac668299774d9e7af4dc616be2f56fdc684d1170882@%3Cusers.activemq.apache.org%3E
- https://lists.apache.org/thread.html/r7f209b837217d2a0fe5977fb692e7f15d37fa5de8214bcdc4c21d9a7@%3Ccommits.turbine.apache.org%3E
- https://lists.apache.org/thread.html/r52a5129df402352adc34d052bab9234c8ef63596306506a89fdc7328@%3Cusers.activemq.apache.org%3E
- https://lists.apache.org/thread.html/r4cd59453b65d4ac290fcb3b71fdf32b4f1f8989025e89558deb5a245@%3Cdev.ws.apache.org%3E
- https://lists.apache.org/thread.html/r3ea4c4c908505b20a4c268330dfe7188b90c84dcf777728d02068ae6@%3Cannounce.apache.org%3E
- https://lists.apache.org/thread.html/r39de20c7e9c808b1f96790875d33e58c9c0aabb44fd9227e7b3dc5da@%3Cdev.ws.apache.org%3E
- https://lists.apache.org/thread.html/r293284c6806c73f51098001ea86a14271c39f72cd76af9e946d9d9ad@%3Cdev.ws.apache.org%3E
- https://lists.apache.org/thread.html/r17cb932fab14801b14e5b97a7f05192f4f366ef260c10d4a8dba8ac9@%3Cdev.ws.apache.org%3E
- https://lists.apache.org/thread.html/r0bc98e9cd080b4a13b905c571b9bed87e1a0878d44dbf21487c6cca4@%3Cdev.santuario.apache.org%3E
- https://lists.apache.org/thread.html/r01043f584cbd47959fabe18fff64de940f81a65024bb8dddbda31d9a@%3Cuser.velocity.apache.org%3E
- https://github.com/apache/velocity-engine
Sources
- CVE-2020-13936 · CVE Program
- CVE-2020-13936 · NVD
- FIRST EPSS
- GHSA-59j4-wjwp-mw9m · GitHub Advisory Database · CC BY 4.0
- CVE-2020-13936 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences