Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
CVE-2020-13942
Summary
Apache Unomi allows conditions to use OGNL and MVEL scripting which offers the possibility to call static Java classes from the JDK that could execute code with the permission level of the running Java process.
- LOW
- NETWORK
- HIGH
- UNCHANGED
- NONE
- NONE
- HIGH
- HIGH
CWE-917 - Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
The software constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.
References
Advisory Timeline
- Published