Improper Input Validation in Apache Unomi

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2020-11975 · ADVISORY
• lists.apache.org/thread.html/r01021bc4b25c1e98812efca0b07f0e078a6281bd52f7c3817a429d95@%3Ccommits.unomi.apache.org%3E · WEB
• lists.apache.org/thread.html/r79672c25e0ef9bb4b9148376281200a8e61c6d5ef5bb705e9a363460@%3Ccommits.unomi.apache.org%3E · WEB
• unomi.apache.org/security/cve-2020-11975.txt · WEB
• lists.apache.org/thread.html/r01021bc4b25c1e98812efca0b07f0e078a6281bd52f7c3817a429d95%40%3Ccommits.unomi.apache.org%3E
• lists.apache.org/thread.html/r79672c25e0ef9bb4b9148376281200a8e61c6d5ef5bb705e9a363460%40%3Ccommits.unomi.apache.org%3E

org.apache.unomi:unomi のその他の脆弱性

• CVE-2021-31164高 7.5Apache Unomi prior to version 1.5.5 allows CRLF log injection because of the lack of escaping in the log statements.
• CVE-2020-13942緊急 9.8It is possible to inject malicious OGNL or MVEL scripts into the /context.json public endpoint. This was partially fixed in 1.5.1 but a new …