CVE-2020-13936

high · 8.8

An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache Velocity Engine versions up to 2.2.

8.8

CVSS

22.7%

EPSS (exploit prob.)

98th

EPSS percentile

2021-03-10

Published

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Vendor	Product	Affected versions
apache	velocity_engine	< 2.3
apache	wss4j	2.3.1
debian	debian_linux	9.0
oracle	banking_deposits_and_lines_of_credit_servicing	2.12.0
oracle	banking_enterprise_default_management	>= 2.3.0, <= 2.4.1
oracle	banking_enterprise_default_management	2.6.2
oracle	banking_enterprise_default_management	2.7.1
oracle	banking_enterprise_default_management	2.10.0
oracle	banking_enterprise_default_management	2.12.0
oracle	banking_loans_servicing	2.12.0
oracle	banking_party_management	2.7.0
oracle	banking_platform	>= 2.3.0, <= 2.4.1
oracle	banking_platform	2.6.2
oracle	banking_platform	2.7.1
oracle	communications_cloud_native_core_policy	1.14.0
oracle	communications_network_integrity	7.3.6
oracle	hospitality_token_proxy_service	19.2
oracle	retail_integration_bus	19.0.1
oracle	retail_order_broker	16.0
oracle	retail_service_backbone	19.0.1
oracle	retail_xstore_office_cloud_service	16.0.6
oracle	retail_xstore_office_cloud_service	17.0.4
oracle	retail_xstore_office_cloud_service	18.0.3
oracle	retail_xstore_office_cloud_service	19.0.2
oracle	retail_xstore_office_cloud_service	20.0.1
oracle	utilities_testing_accelerator	6.0.0.1.1
oracle	utilities_testing_accelerator	6.0.0.2.2
oracle	utilities_testing_accelerator	6.0.0.3.1

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2020-13936