CVE-2020-13151

🗓️ 05 Aug 2020 12:36:39Reported by mitreType

cve🔗 web.nvd.nist.gov👁 306 Views🌐 WEB

Aerospike Community Edition 4.9.0.5 allows unauthenticated execution of user-defined functions, leading to arbitrary OS command execution

Reporter	Title	Published	Views	Family All 17
GithubExploit	Exploit for OS Command Injection in Aerospike Aerospike_Server	1 Aug 202014:29	–	githubexploit
0day.today	Aerospike Database 5.1.0.3 - OS Command Execution Exploit	17 Nov 202000:00	–	zdt
0day.today	Aerospike Database UDF Lua Code Execution Exploit	11 Dec 202000:00	–	zdt
IBM Security Bulletins	Security Bulletin: Vulnerabilities exists in IBM Netezza Analytics - NPS	11 Jul 202511:19	–	ibm
Circl	CVE-2020-13151	5 Aug 202016:55	–	circl
CNVD	Aerospike Operating System Command Injection Vulnerability	6 Aug 202000:00	–	cnvd
Check Point Advisories	Aerospike Community Remote Code Execution (CVE-2020-13151)	16 Dec 202000:00	–	checkpoint_advisories
Cvelist	CVE-2020-13151	5 Aug 202012:36	–	cvelist
Exploit DB	Aerospike Database 5.1.0.3 - OS Command Execution	17 Nov 202000:00	–	exploitdb
Metasploit	Aerospike Database UDF Lua Code Execution	10 Dec 202017:41	–	metasploit

NVD

Node

aerospike aerospike_serverRange4.6.0.1–4.6.0.19community

aerospike aerospike_serverRange4.7.0.1–4.7.0.17community

aerospike aerospike_serverRange4.8.0.1–4.8.0.13community

aerospike aerospike_serverRange4.9.0.1–4.9.0.10community

aerospike aerospike_serverRange5.0.0.1–5.0.0.7community

Source	Link
aerospike	www.aerospike.com/enterprise/download/server/notes.html
packetstormsecurity	www.packetstormsecurity.com/files/160451/Aerospike-Database-UDF-Lua-Code-Execution.html
aerospike	www.aerospike.com/docs/operations/configure/security/access-control/index.html
packetstormsecurity	www.packetstormsecurity.com/files/160106/Aerospike-Database-5.1.0.3-Remote-Command-Execution.html
aerospike	www.aerospike.com/download/server/notes.html
b4ny4n	www.b4ny4n.github.io/network-pentest/2020/08/01/cve-2020-13151-poc-aerospike.html

Parameter	Position	Path	Description	CWE
filename	binary	udf-put:filename=<name>;content=<base64>;content-len=<len>;udf-type=LUA	Upload a Lua UDF to the Aerospike server to enable code execution via os.execute	CWE-78
content	binary	udf-put:filename=<name>;content=<base64>;content-len=<len>;udf-type=LUA	Upload a Lua UDF to the Aerospike server to enable code execution via os.execute	CWE-78
content-len	binary	udf-put:filename=<name>;content=<base64>;content-len=<len>;udf-type=LUA	Upload a Lua UDF to the Aerospike server to enable code execution via os.execute	CWE-78
udf-type	binary	udf-put:filename=<name>;content=<base64>;content-len=<len>;udf-type=LUA	Upload a Lua UDF to the Aerospike server to enable code execution via os.execute	CWE-78
filename	binary	udf-remove:filename=<name>	Remove a previously uploaded UDF from the Aerospike server	CWE-78

17 Jun 2026 02:52Current

9.7High risk

Vulners AI Score9.7

CVSS 3.19.8

CVSS 210

EPSS0.86749