{"id":"CVE-2020-11975","aliases":["EUVD-2022-1189","GHSA-v6fq-q792-j46j"],"status":"published","title":"Improper Input Validation in Apache Unomi","description":"Apache Unomi allows conditions to use OGNL scripting which offers the possibility to call static Java classes from the JDK that could execute code with the permission level of the running Java process.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.3061,"percentile":0.98256,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-20"],"published":"2020-06-05T14:10:57Z","modified":"2026-10-24T10:30:41Z","exploits":[{"source":"pocgithub","id":"1135/unomi_exploit","title":"1135/unomi_exploit","date":"2020-11-24","url":"https://github.com/1135/unomi_exploit"},{"source":"nuclei","id":"CVE-2020-11975","title":"Apache Unomi - Remote Code Execution","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-11975.yaml"}],"fixes":[{"ecosystem":"Maven","package":"org.apache.unomi:unomi","fixed_in":["1.5.4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.unomi:unomi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.4"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.unomi:unomi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.4"}]}],"versions":["1.0.0-incubating","1.1.0-incubating","1.2.0-incubating","1.3.0-incubating","1.5.0","1.5.1","1.5.2","1.5.3"]}],"products":[{"vendor":"apache","product":"unomi"},{"vendor":"apache software foundation","product":"apache unomi"}],"references":[{"url":"http://unomi.apache.org/security/cve-2020-11975.txt","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","fix","web"]},{"url":"https://lists.apache.org/thread.html/r01021bc4b25c1e98812efca0b07f0e078a6281bd52f7c3817a429d95%40%3Ccommits.unomi.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r79672c25e0ef9bb4b9148376281200a8e61c6d5ef5bb705e9a363460%40%3Ccommits.unomi.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-11975","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/r01021bc4b25c1e98812efca0b07f0e078a6281bd52f7c3817a429d95@%3Ccommits.unomi.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r79672c25e0ef9bb4b9148376281200a8e61c6d5ef5bb705e9a363460@%3Ccommits.unomi.apache.org%3E","tags":["web"]},{"url":"https://github.com/advisories/GHSA-v6fq-q792-j46j"}],"sources":{"cve":[{"id":"CVE-2020-11975","description":"Apache Unomi allows conditions to use OGNL scripting which offers the possibility to call static Java classes from the JDK that could execute code with the permission level of the running Java process.","status":"published","published":"2020-06-05T14:10:57Z","modified":"2024-08-04T11:48:57.089Z","updated_at":"2026-11-02T14:35:57.352161Z"}],"euvd":[{"id":"EUVD-2022-1189","description":"Apache Unomi allows conditions to use OGNL scripting which offers the possibility to call static Java classes from the JDK that could execute code with the permission level of the running Java process.","status":"published","published":"2020-06-05T14:10:57Z","modified":"2024-08-04T11:48:57Z","updated_at":"2026-11-03T03:07:41.399649Z"}],"ghsa":[{"id":"GHSA-v6fq-q792-j46j","title":"Improper Input Validation in Apache Unomi","description":"Apache Unomi allows conditions to use OGNL scripting which offers the possibility to call static Java classes from the JDK that could execute code with the permission level of the running Java process.","status":"published","published":"2022-02-09T23:20:47Z","modified":"2023-02-01T05:05:25Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:36:34.260786Z"}],"nvd":[{"id":"CVE-2020-11975","description":"Apache Unomi allows conditions to use OGNL scripting which offers the possibility to call static Java classes from the JDK that could execute code with the permission level of the running Java process.","status":"published","published":"2020-06-05T15:15:10.723Z","modified":"2026-06-17T02:51:10.157Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:06:05.962132Z"}],"osv":[{"id":"CVE-2020-11975","description":"Apache Unomi allows conditions to use OGNL scripting which offers the possibility to call static Java classes from the JDK that could execute code with the permission level of the running Java process.","status":"published","published":"2020-06-05T15:15:10.723Z","modified":"2026-10-24T10:30:41.321809788Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:14.034736Z"},{"id":"GHSA-v6fq-q792-j46j","title":"Improper Input Validation in Apache Unomi","description":"Apache Unomi allows conditions to use OGNL scripting which offers the possibility to call static Java classes from the JDK that could execute code with the permission level of the running Java process.","status":"published","published":"2022-02-09T23:20:47Z","modified":"2023-11-08T04:02:08.117151Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:56.981655Z"}]}}