High severity · published Mar 10, 2021
CVE-2020-13936
An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet…
8.8
CVSS
22.7%
EPSS
No
On KEV
Description
An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache Velocity Engine versions up to 2.2.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)22.7% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BD
Banking Deposits And Lines OF Credit Servicing · Oracle
2.12.0 · source: NVD
BE
Banking Enterprise Default Management · Oracle
2.3.0 through 2.4.1; 2.6.2; 2.7.1; 2.10.0; 2.12.0 · source: NVD
BL
Banking Loans Servicing · Oracle
2.12.0 · source: NVD
BP
Banking Party Management · Oracle
2.7.0 · source: NVD
BP
Banking Platform · Oracle
2.3.0 through 2.4.1; 2.6.2; 2.7.1 · source: NVD
CC
Communications Cloud Native Core Policy · Oracle
1.14.0 · source: NVD
CN
Communications Network Integrity · Oracle
7.3.6 · source: NVD
DL
Debian Linux · Debian
9.0 · source: NVD
HT
Hospitality Token Proxy Service · Oracle
19.2 · source: NVD
RI
Retail Integration Bus · Oracle
19.0.1 · source: NVD
RO
Retail Order Broker · Oracle
16.0 · source: NVD
RS
Retail Service Backbone · Oracle
19.0.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-13936
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-13936
Mailing List
http://www.openwall.com/lists/oss-security/2021/03/10/1
Mailing List
https://lists.apache.org/thread.html/r01043f584cbd47959fabe18fff64de940f81a65024bb8dddbda31d9a%40%3Cuser.velocity.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r0bc98e9cd080b4a13b905c571b9bed87e1a0878d44dbf21487c6cca4%40%3Cdev.santuario.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r17cb932fab14801b14e5b97a7f05192f4f366ef260c10d4a8dba8ac9%40%3Cdev.ws.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r293284c6806c73f51098001ea86a14271c39f72cd76af9e946d9d9ad%40%3Cdev.ws.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r39de20c7e9c808b1f96790875d33e58c9c0aabb44fd9227e7b3dc5da%40%3Cdev.ws.apache.org%3E