Not rated
CVE-2020-13936 An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands…
Description
An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache Velocity Engine versions up to 2.2.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache Velocity Engine 2.2 | earliest → 2.2 | No fix stated |
References
- lists.apache.org lists.apache.org
- [velocity-commits] 20210310 [velocity-site] 01/01: CVE announcement lists.apache.org
- [oss-security] 20210309 CVE-2020-13936: Velocity Sandbox Bypass www.openwall.com
- [announce] 20210310 CVE-2020-13936: Velocity Sandbox Bypass lists.apache.org
- [druid-commits] 20210316 [GitHub] [druid] clintropolis opened a new pull request #11002: suppress CVE check for security fix lists.apache.org
- [debian-lts-announce] 20210317 [SECURITY] [DLA 2595-1] velocity security update lists.debian.org
- [ws-dev] 20210318 [jira] [Commented] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936) lists.apache.org
- [ws-dev] 20210318 [jira] [Created] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936) lists.apache.org
- [ws-dev] 20210319 [jira] [Commented] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936) lists.apache.org
- [ws-dev] 20210319 [jira] [Comment Edited] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936) lists.apache.org
- [ws-dev] 20210322 [jira] [Commented] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936) lists.apache.org
- [santuario-dev] 20210323 [GitHub] [santuario-xml-security-java] dependabot[bot] opened a new pull request #33: Bump dependency-check-maven from 6.1.2 to 6.1.3 lists.apache.org
- [ws-dev] 20210324 [jira] [Commented] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936) lists.apache.org
- [ws-dev] 20210325 [jira] [Updated] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936) lists.apache.org
- [ws-dev] 20210325 [jira] [Commented] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936) lists.apache.org
- [turbine-commits] 20210329 svn commit: r1888167 - /turbine/core/trunk/pom.xml lists.apache.org
- [ws-dev] 20210331 [jira] [Commented] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936) lists.apache.org
- [ws-dev] 20210401 [jira] [Commented] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936) lists.apache.org
- GLSA-202107-52 security.gentoo.org
- [activemq-users] 20210830 Security issues lists.apache.org
- [activemq-users] 20210831 RE: Security issues lists.apache.org
- www.oracle.com www.oracle.com
- www.oracle.com www.oracle.com
Timeline
- Published
- Last modified