Command injection in Apache Unomi

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2021-31164 · ADVISORY
• unomi.apache.org/security/cve-2021-31164 · WEB

org.apache.unomi:unomi のその他の脆弱性

• CVE-2020-13942緊急 9.8It is possible to inject malicious OGNL or MVEL scripts into the /context.json public endpoint. This was partially fixed in 1.5.1 but a new …
• CVE-2020-11975緊急 9.8Apache Unomi allows conditions to use OGNL scripting which offers the possibility to call static Java classes from the JDK that could execut…