Remote Code Execution in Apache Unomi
Priority HIGH 79CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.
Summary
It is possible to inject malicious OGNL or MVEL scripts into the /context.json public endpoint. This was partially fixed in 1.5.1 but a new attack vector was found. In Apache Unomi version 1.5.2 scripts are now completely filtered from the input. It is highly recommended to upgrade to the latest available version of the 1.5.x release to fix this problem.
Why it matters now
EPSS 0.68516 99th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Apache Unomi (Apache Software Foundation): 1.5.2org.apache.unomi:unomi (Maven): 1.5.2
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Unomi | before 1.5.2 | 1.5.2 | Patch available | CNA |
| — | org.apache.unomi:unomi (Maven) | before 1.5.2 | 1.5.2 | Patch available | GHSA-xp5j-wj4h-2jq9 |
- Apache Unomi VendorApache Affected before 1.5.2 Fixed in 1.5.2 Patch available CNA
- org.apache.unomi:unomi (Maven) Vendor— Affected before 1.5.2 Fixed in 1.5.2 Patch available GHSA-xp5j-wj4h-2jq9
Remediation
- Fix · CNA Apache Unomi (Apache Software Foundation) Fixed in 1.5.2
- Fix · GHSA-xp5j-wj4h-2jq9 org.apache.unomi:unomi (Maven) Fixed in 1.5.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2020-13942
- 2026-10-03 Alias added: GHSA-xp5j-wj4h-2jq9
References
Advisory 3
Other 12
- [unomi-dev] 20201124 CVE-2020-13942: Remote Code Execution in Apache Unomi
- [unomi-users] 20201124 CVE-2020-13942: Remote Code Execution in Apache Unomi
- [unomi-users] 20201124 Apache Unomi 1.5.4 Release
- [unomi-dev] 20201124 Apache Unomi 1.5.4 Release
- [announce] 20201124 CVE-2020-13942: Remote Code Execution in Apache Unomi
- [unomi-commits] 20210428 svn commit: r1889256 - in /unomi/website: contribute-release-guide.html documentation.html download.html index.html security/cve-2021-31164.txt
- https://lists.apache.org/thread.html/r08a4057ff7196b8880117edaa4b6207cbd36ed692d8dd1f5a56b4d0f@%3Cannounce.apache.org%3E
- https://lists.apache.org/thread.html/r4a8fa91836687eaca42b5420a778ca8c8fd3a3740e4cf4401acc9118@%3Cdev.unomi.apache.org%3E
- https://lists.apache.org/thread.html/r4a8fa91836687eaca42b5420a778ca8c8fd3a3740e4cf4401acc9118@%3Cusers.unomi.apache.org%3E
- https://lists.apache.org/thread.html/r79672c25e0ef9bb4b9148376281200a8e61c6d5ef5bb705e9a363460@%3Ccommits.unomi.apache.org%3E
- https://lists.apache.org/thread.html/rcb6d2eafcf15def433aaddfa06738e5faa5060cef2647769e178999a@%3Cdev.unomi.apache.org%3E
- https://lists.apache.org/thread.html/rcb6d2eafcf15def433aaddfa06738e5faa5060cef2647769e178999a@%3Cusers.unomi.apache.org%3E
More Apache Unomi vulnerabilities
- TI-2020-09635 Improper input validation in Apache Unomi CVSS 3.1CRITICAL 9.8
- TI-2021-11384 Apache Unomi log injection CVSS 3.1HIGH 7.5
Sources
- CVE-2020-13942 · CVE Program
- CVE-2020-13942 · NVD
- FIRST EPSS
- GHSA-xp5j-wj4h-2jq9 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences