CVE-2020-13936

Published: Mar 10, 2021Modified: Nov 21, 2024

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache Velocity Engine versions up to 2.2.

Affected (28)

Products: Apache: Velocity Engine, Wss4j · Debian: Debian Linux · Oracle: Banking Deposits And Lines Of Credit Servicing, Banking Enterprise Default Management, Banking Loans Servicing, Banking Party Management, Banking Platform, Communications Cloud Native Core Policy, Communications Network Integrity, Hospitality Token Proxy Service, Retail Integration Bus, Retail Order Broker, Retail Service Backbone, Retail Xstore Office Cloud Service, Utilities Testing Accelerator

2 products

1 product

13 products

Banking Deposits And Lines Of Credit Servicing

Banking Enterprise Default Management

Banking Loans Servicing

Banking Party Management

Banking Platform

Communications Cloud Native Core Policy

Communications Network Integrity

Hospitality Token Proxy Service

Retail Integration Bus

Retail Order Broker

Retail Service Backbone

Retail Xstore Office Cloud Service

Utilities Testing Accelerator

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Apache Velocity Engine	Before 2.3
Apache Wss4j	Version 2.3.1

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 9.0

Configuration C

25 vulnerable

Vulnerable Software	Affected Versions
Oracle Banking Deposits And Lines Of Credit Servicing	Version 2.12.0
Oracle Banking Enterprise Default Management	From 2.3.0 to 2.4.1
Oracle Banking Enterprise Default Management	Version 2.10.0
Oracle Banking Enterprise Default Management	Version 2.12.0
Oracle Banking Enterprise Default Management	Version 2.6.2
Oracle Banking Enterprise Default Management	Version 2.7.1
Oracle Banking Loans Servicing	Version 2.12.0
Oracle Banking Party Management	Version 2.7.0
Oracle Banking Platform	From 2.3.0 to 2.4.1
Oracle Banking Platform	Version 2.6.2
Oracle Banking Platform	Version 2.7.1
Oracle Communications Cloud Native Core Policy	Version 1.14.0
Oracle Communications Network Integrity	Version 7.3.6
Oracle Hospitality Token Proxy Service	Version 19.2
Oracle Retail Integration Bus	Version 19.0.1
Oracle Retail Order Broker	Version 16.0
Oracle Retail Service Backbone	Version 19.0.1
Oracle Retail Xstore Office Cloud Service	Version 16.0.6
Oracle Retail Xstore Office Cloud Service	Version 17.0.4
Oracle Retail Xstore Office Cloud Service	Version 18.0.3
Oracle Retail Xstore Office Cloud Service	Version 19.0.2
Oracle Retail Xstore Office Cloud Service	Version 20.0.1
Oracle Utilities Testing Accelerator	Version 6.0.0.1.1
Oracle Utilities Testing Accelerator	Version 6.0.0.2.2
Oracle Utilities Testing Accelerator	Version 6.0.0.3.1

References (48)

http://www.openwall.com/lists/oss-security/2021/03/10/1

Source: security@apache.org

Mailing ListThird Party Advisory

https://lists.apache.org/thread.html/r01043f584cbd47959fabe18fff64de940f81a65024bb8dddbda31d9a%40%3Cuser.velocity.apache.org%3E

Source: security@apache.org

Mailing ListVendor Advisory

https://lists.apache.org/thread.html/r01043f584cbd47959fabe18fff64de940f81a65024bb8dddbda31d9a%40%3Cuser.velocity.apache.org%3E

Source: security@apache.org

Mailing ListVendor Advisory

https://lists.apache.org/thread.html/r0bc98e9cd080b4a13b905c571b9bed87e1a0878d44dbf21487c6cca4%40%3Cdev.santuario.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r17cb932fab14801b14e5b97a7f05192f4f366ef260c10d4a8dba8ac9%40%3Cdev.ws.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r293284c6806c73f51098001ea86a14271c39f72cd76af9e946d9d9ad%40%3Cdev.ws.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r39de20c7e9c808b1f96790875d33e58c9c0aabb44fd9227e7b3dc5da%40%3Cdev.ws.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r3ea4c4c908505b20a4c268330dfe7188b90c84dcf777728d02068ae6%40%3Cannounce.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r4cd59453b65d4ac290fcb3b71fdf32b4f1f8989025e89558deb5a245%40%3Cdev.ws.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r52a5129df402352adc34d052bab9234c8ef63596306506a89fdc7328%40%3Cusers.activemq.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r7f209b837217d2a0fe5977fb692e7f15d37fa5de8214bcdc4c21d9a7%40%3Ccommits.turbine.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r9dc2505651788ac668299774d9e7af4dc616be2f56fdc684d1170882%40%3Cusers.activemq.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/rb042f3b0090e419cc9f5a3d32cf0baff283ccd6fcb1caea61915d6b6%40%3Ccommits.velocity.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/rbee7270556f4172322936b5ecc9fabf0c09f00d4fa56c9de1963c340%40%3Cdev.ws.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/rd2a89e17e8a9b451ce655f1a34117752ea1d18a22ce580d8baa824fd%40%3Ccommits.druid.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/rd7e865c87f9043c21d9c1fd9d4df866061d9a08cfc322771160d8058%40%3Cdev.ws.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/re641197d204765130618086238c73dd2ce5a3f94b33785b587d72726%40%3Cdev.ws.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/re8e7482fe54d289fc0229e61cc64947b63b12c3c312e9f25bf6f3b8c%40%3Cdev.ws.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/reab5978b54a9f4c078402161e30a89c42807b198814acadbe6c862c7%40%3Cdev.ws.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/rf7d369de88dc88a1347006a3323b3746d849234db40a8edfd5ebc436%40%3Cdev.ws.apache.org%3E

Source: security@apache.org

https://lists.debian.org/debian-lts-announce/2021/03/msg00019.html

Source: security@apache.org

Mailing ListThird Party Advisory

https://security.gentoo.org/glsa/202107-52

Source: security@apache.org

Third Party Advisory

https://www.oracle.com/security-alerts/cpuapr2022.html

Source: security@apache.org

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujan2022.html

Source: security@apache.org

PatchThird Party Advisory

http://www.openwall.com/lists/oss-security/2021/03/10/1