Vulnerabilities > CVE-2020-13936

CVSS 9.0 - CRITICAL

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

SINGLE

Confidentiality impact

COMPLETE

Integrity impact

COMPLETE

Availability impact

COMPLETE

network

low complexity

apache

debian

oracle

critical

NVD

Published: 2021-03-10

Updated: 2022-05-12

Summary

An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache Velocity Engine versions up to 2.2.

Vulnerable Configurations

Part	Description	Count
Application	Apache Apache Velocity Engine 1.4 Apache Velocity Engine 1.5 Apache Velocity Engine 1.6 Apache Velocity Engine 1.6.1 Apache Velocity Engine 1.6.2 Apache Velocity Engine 1.7 Apache Velocity Engine 2.0 Apache Velocity Engine 2.1 Apache Velocity Engine 2.2 Apache Wss4J 2.3.1	10
Application	Oracle Oracle Retail Order Broker 16.0 Oracle Banking Platform 2.6.2 Oracle Banking Platform 2.7.1 Oracle Banking Platform 2.3.0 Oracle Banking Platform 2.4.0 Oracle Banking Platform 2.4.1 Oracle Communications Network Integrity 7.3.6 Oracle Banking Enterprise Default Management 2.12.0 Oracle Banking Enterprise Default Management 2.10.0 Oracle Banking Enterprise Default Management 2.3.0 Oracle Banking Enterprise Default Management 2.4.1 Oracle Banking Enterprise Default Management 2.6.2 Oracle Banking Enterprise Default Management 2.7.1 Oracle Banking Party Management 2.7.0 Oracle Utilities Testing Accelerator 6.0.0.2.2 Oracle Utilities Testing Accelerator 6.0.0.3.1 Oracle Utilities Testing Accelerator 6.0.0.1.1 Oracle Banking Deposits AND Lines OF Credit Servicing 2.12.0 Oracle Banking Loans Servicing 2.12.0 Oracle Communications Cloud Native Core Policy 1.14.0 Oracle Hospitality Token Proxy Service 19.2 Oracle Retail Integration BUS 19.0.1 Oracle Retail Service Backbone 19.0.1 Oracle Retail Xstore Office Cloud Service 16.0.6 Oracle Retail Xstore Office Cloud Service 17.0.4 Oracle Retail Xstore Office Cloud Service 18.0.3 Oracle Retail Xstore Office Cloud Service 19.0.2 Oracle Retail Xstore Office Cloud Service 20.0.1	28
OS	Debian Debian Debian Linux 9.0	1

Vulnerabilities > CVE-2020-13936 {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Vulnerabilities","item":"https://cyber.vumetric.com/vulns/"},{"@type":"ListItem","position":2,"name":"CVE-2020-13936"}]}

Summary

Vulnerable Configurations

References

Vulnerabilities > CVE-2020-13936