Apache Unomi
By the Year
In 2023 there have been 0 vulnerabilities in Apache Unomi . Unomi did not have any published security vulnerabilities last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2023 | 0 | 0.00 |
| 2022 | 0 | 0.00 |
| 2021 | 1 | 7.50 |
| 2020 | 2 | 9.80 |
| 2019 | 0 | 0.00 |
| 2018 | 0 | 0.00 |
It may take a day or so for new Unomi vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Apache Unomi Security Vulnerabilities
Apache Unomi prior to version 1.5.5
CVE-2021-31164
7.5 - High
- May 04, 2021
Apache Unomi prior to version 1.5.5 allows CRLF log injection because of the lack of escaping in the log statements.
Injection
It is possible to inject malicious OGNL or MVEL scripts into the /context.json public endpoint
CVE-2020-13942
9.8 - Critical
- November 24, 2020
It is possible to inject malicious OGNL or MVEL scripts into the /context.json public endpoint. This was partially fixed in 1.5.1 but a new attack vector was found. In Apache Unomi version 1.5.2 scripts are now completely filtered from the input. It is highly recommended to upgrade to the latest available version of the 1.5.x release to fix this problem.
Injection
Apache Unomi allows conditions to use OGNL scripting which offers the possibility to call static Java classes from the JDK
CVE-2020-11975
9.8 - Critical
- June 05, 2020
Apache Unomi allows conditions to use OGNL scripting which offers the possibility to call static Java classes from the JDK that could execute code with the permission level of the running Java process.
Improper Input Validation
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Apache Unomi or by Apache? Click the Watch button to subscribe.
