CVE-2020-14987

An issue was discovered in Bloomreach Experience Manager (brXM) 4.1.0 through 14.2.2. It allows remote attackers to execute arbitrary code because there is a mishandling of the capability for administrators to write and run Groovy scripts within the updater editor. An attacker must use an AST transforming annotation such as @Grab.

• CWE-74
• CWE-862

• https://tvrbk.github.io/cve/2021/03/09/brXM.htmlExploit, Third Party Advisory
• https://tvrbk.github.io/cve/2021/03/09/brXM.htmlExploit, Third Party Advisory

Published

Mar 11, 2021

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-14979The WinRing0.sys and WinRing0x64.sys drivers 1.2.0 in EVGA P…7.8
• CVE-2020-1498A remote code execution vulnerability exists in Microsoft Ex…8.8
• CVE-2020-14980The Sophos Secure Email application through 3.9.4 for Androi…5.9
• CVE-2020-14981The ThreatTrack VIPRE Password Vault app through 1.100.1090 …5.9
• CVE-2020-14982A Blind SQL Injection vulnerability in Kronos WebTA 3.8.x an…6.5
• CVE-2020-14983The server in Chocolate Doom 3.0.0 and Crispy Doom 5.8.0 doe…9.8
• CVE-2020-14988An issue was discovered in Bloomreach Experience Manager (br…5.4
• CVE-2020-14989An issue was discovered in Bloomreach Experience Manager (br…6.5
• CVE-2020-1499A spoofing vulnerability exists when Microsoft SharePoint Se…5.4
• CVE-2020-14990IOBit Advanced SystemCare Free 13.5.0.263 allows local users…7.1
• CVE-2020-14993A stack-based buffer overflow on DrayTek Vigor2960, Vigor390…9.8
• CVE-2020-14999A logic bug in system monitoring driver of Acronis Agent aft…7.5