CVE-2020-11975: Improper Input Validation in Apache Unomi
Summary
CVE-2020-11975: Improper Input Validation in Apache Unomi. Affects org.apache.unomi:unomi versions < 1.5.4. Fixed in 1.5.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Unomi is a customer data platform that allows organizations to collect, store, and analyze customer data. It provides a set of APIs and features for managing customer profiles, personalization, and segmentation. The vulnerability identified as CVE-2020-11975 in Apache Unomi is related to improper input validation. Specifically, it allows conditions to use OGNL scripting, which can potentially call static Java classes from the JDK and execute code with the permission level of the running Java process.
Vulnerability Detail
The vulnerability arises from the ability to execute arbitrary code through OGNL scripting. By exploiting this vulnerability, an attacker could execute malicious code with the same permissions as the Java process running Apache Unomi. This could lead to various consequences, such as unauthorized access to sensitive data, remote code execution, or even a complete compromise of the affected system. The severity of this vulnerability is rated as HIGH with a CVSS score of 9.8.
How To Fix
Minimum fixed version
1.5.4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is advised to disable the execution of OGNL scripting in Apache Unomi. This can be achieved by modifying the configuration to disallow the use of OGNL scripting in conditions. Here is an example of how to disable OGNL scripting in Apache Unomi's configuration:
unomi.conditions.allowOgnl = false
By setting the unomi.conditions.allowOgnl property to false, the vulnerability can be mitigated until the upgrade to a fixed version is performed.
Conclusion
In conclusion, the vulnerability CVE-2020-11975 in Apache Unomi allows for the execution of arbitrary code through OGNL scripting. This can lead to severe consequences, including unauthorized access, data breaches, and system compromise. It is crucial to upgrade Apache Unomi to version 1.5.4 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.unomi:unomi →
FAQ
Apache Unomi is a customer data platform that enables organizations to collect, store, and analyze customer data for personalized marketing and customer experience management.
OGNL (Object-Graph Navigation Language) is a scripting language used in Apache Unomi to define conditions. It allows accessing and manipulating Java objects through a simple expression language.
This vulnerability allows an attacker to execute arbitrary code with the same permissions as the Java process running Apache Unomi. This can lead to unauthorized access, data breaches, or even complete compromise of the affected system.
The severity of this vulnerability is rated as HIGH with a CVSS score of 9.8.
To fix this vulnerability, it is recommended to upgrade Apache Unomi to version 1.5.4 or later, which includes a fix for the improper input validation issue.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.unomi:unomi.
