Attacker Value
Unknown
CVE-2020-13936
CVE-2020-13936
(Last updated November 08, 2023) ▾
MITRE ATT&CK
Log in to add MITRE ATT&CK tag
Add MITRE ATT&CK tactics and techniques that apply to this CVE.
Description
An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache Velocity Engine versions up to 2.2.
Add Assessment
No one has assessed this topic. Be the first to add your voice to the community.
CVSS V3 Severity and Metrics
Data provided by the National Vulnerability Database (NVD)
Base Score:
8.8 High
Impact Score:
5.9
Exploitability Score:
2.8
Attack Vector (AV):
Network
Attack Complexity (AC):
Low
Privileges Required (PR):
Low
User Interaction (UI):
None
Scope (S):
Unchanged
Confidentiality (C):
High
Integrity (I):
High
Availability (A):
High
General Information
Vendors
- apache,
- debian,
- oracle
Products
- banking deposits and lines of credit servicing 2.12.0,
- banking enterprise default management,
- banking enterprise default management 2.10.0,
- banking enterprise default management 2.12.0,
- banking enterprise default management 2.6.2,
- banking enterprise default management 2.7.1,
- banking loans servicing 2.12.0,
- banking party management 2.7.0,
- banking platform,
- banking platform 2.6.2,
- banking platform 2.7.1,
- communications cloud native core policy 1.14.0,
- communications network integrity 7.3.6,
- debian linux 9.0,
- hospitality token proxy service 19.2,
- retail integration bus 19.0.1,
- retail order broker 16.0,
- retail service backbone 19.0.1,
- retail xstore office cloud service 16.0.6,
- retail xstore office cloud service 17.0.4,
- retail xstore office cloud service 18.0.3,
- retail xstore office cloud service 19.0.2,
- retail xstore office cloud service 20.0.1,
- utilities testing accelerator 6.0.0.1.1,
- utilities testing accelerator 6.0.0.2.2,
- utilities testing accelerator 6.0.0.3.1,
- velocity engine,
- wss4j 2.3.1
References
Advisory
