Strix
26.1K

CVE-2020-13936

HIGHCVSS 8.8/10EPSS 22.71%

Last modified

CVE-2020-13936 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache Velocity Engine versions up to 2.2.. EPSS estimates a 22.71% chance of exploitation in the next 30 days.

Description

An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache Velocity Engine versions up to 2.2.

Metrics

CVSS 3.1
8.8/10

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Probability
22.71%

97.4th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

VendorProductVersions
ApacheVelocity Engine< 2.3
ApacheWss4j2.3.1
DebianDebian Linux9.0
OracleBanking Deposits And Lines Of Credit Servicing2.12.0
OracleBanking Enterprise Default Management>= 2.3.0, <= 2.4.1
OracleBanking Enterprise Default Management2.6.2
OracleBanking Enterprise Default Management2.7.1
OracleBanking Enterprise Default Management2.10.0
OracleBanking Enterprise Default Management2.12.0
OracleBanking Loans Servicing2.12.0
OracleBanking Party Management2.7.0
OracleBanking Platform>= 2.3.0, <= 2.4.1
OracleBanking Platform2.6.2
OracleBanking Platform2.7.1
OracleCommunications Cloud Native Core Policy1.14.0
OracleCommunications Network Integrity7.3.6
OracleHospitality Token Proxy Service19.2
OracleRetail Integration Bus19.0.1
OracleRetail Order Broker16.0
OracleRetail Service Backbone19.0.1
OracleRetail Xstore Office Cloud Service16.0.6
OracleRetail Xstore Office Cloud Service17.0.4
OracleRetail Xstore Office Cloud Service18.0.3
OracleRetail Xstore Office Cloud Service19.0.2
OracleRetail Xstore Office Cloud Service20.0.1
OracleUtilities Testing Accelerator6.0.0.1.1
OracleUtilities Testing Accelerator6.0.0.2.2
OracleUtilities Testing Accelerator6.0.0.3.1

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2020-13936?
An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache Velocity Engine versions up to 2.2.
How severe is CVE-2020-13936?
CVE-2020-13936 has a CVSS score of 8.8/10 (HIGH severity). The EPSS model estimates a 22.71% probability of exploitation in the next 30 days.
How do I fix CVE-2020-13936?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2020-13936?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST