WaratekVRT Sign in

Unomi CVEs

3 CVEs, 2 exploited

Reset
More filters (1)
Columns
Product unomi✕
Overview 3 matches · 0 protected · 2 exploited · 0 CISA KEV · 2 public PoC · 1 EPSS ≥ 0.5
3matches 0protected0.0% 2exploited66.7% 0CISA KEV0.0% 2public PoC66.7% 1EPSS ≥ 0.533.3%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 2 66.7% No exploit published 1 33.3%
Critical 2 66.7% High 1 33.3% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 3 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 2 66.7% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 1 33.3%
split by peak 1 / month
No exploit published: 1Mitigation candidate: 2 High: 1Critical: 2 not blocked: 3 No public exploit: 1Exploited: 2
Jun 201 Mitigation candidate1 Critical1 not blocked1 Exploited1 Jul 200 Aug 200 Sep 200 Oct 200 Nov 201 Mitigation candidate1 Critical1 not blocked1 Exploited1 Dec 200 Jan 210 Feb 210 Mar 210 Apr 210 May 211 No exploit published1 High1 not blocked1 No public exploit1
Jun 20Jul 20Aug 20Sep 20Oct 20Nov 20Dec 20Jan 21Feb 21Mar 21Apr 21May 21
3 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2021-31164 High 2021-05-04 No exploit published No public exploit Apache Unomi prior to version 1.5.5 allows CRLF log injection because of the lack of escaping in the log statements.
CVE-2020-13942 Critical 2020-11-24 Mitigation candidate Exploited It is possible to inject malicious OGNL or MVEL scripts into the /context.json public endpoint. This was partially fixed in 1.5.1 but a new attack vector was found. In Apache Unomi version 1.5.2 scripts are now completely filtered from the input. It is highly recommended to upgrade to the latest available version of the 1.5.x release to fix this problem.
CVE-2020-11975 Critical 2020-06-05 Mitigation candidate Exploited Apache Unomi allows conditions to use OGNL scripting which offers the possibility to call static Java classes from the JDK that could execute code with the permission level of the running Java process.