Lucene search

CVE-2020-13936

🗓️ 10 Mar 2021 08:14:15Reported by apacheType

cve🔗 web.nvd.nist.gov📰️ 24 Media mentions👁 363 Views

An attacker may execute arbitrary Java code or run system commands by modifying Velocity templates, affecting Apache Velocity Engine versions up to 2.2

AI Insights are available for you today

Leverage the power of AI to quickly understand vulnerabilities, impacts, and exploitability

Reporter	Title	Published	Views	Family All 102
Tenable Nessus	RHEL 8 : velocity (Unpatched Vulnerability)	3 Jun 202400:00	–	nessus
Tenable Nessus	SUSE SLED15 / SLES15 / openSUSE 15 : Recommended update for Maven (SUSE-SU-2025:0719-1)	27 Feb 202500:00	–	nessus
Tenable Nessus	Debian DLA-2595-1 : velocity security update	19 Mar 202100:00	–	nessus
Tenable Nessus	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS : Velocity Engine vulnerability (USN-6281-1)	10 Aug 202300:00	–	nessus
Tenable Nessus	Oracle WebLogic Server (April 2025 CPU)	17 Apr 202500:00	–	nessus
Tenable Nessus	Amazon Linux 2 : velocity (ALAS-2021-1690)	16 Jul 202100:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP5 : velocity (EulerOS-SA-2021-2233)	16 Jul 202100:00	–	nessus
Tenable Nessus	RHEL 7 : velocity (Unpatched Vulnerability)	11 May 202400:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP2 : velocity (EulerOS-SA-2021-2437)	14 Sep 202100:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP8 : velocity (EulerOS-SA-2021-1990)	28 Jun 202100:00	–	nessus

Nvd

Vulners

Node

apache velocity_engineRange<2.3

apache wss4jMatch2.3.1

Node

debian debian_linuxMatch9.0

Node

oracle banking_deposits_and_lines_of_credit_servicingMatch2.12.0

oracle banking_enterprise_default_managementRange2.3.0–2.4.1

oracle banking_enterprise_default_managementMatch2.6.2

oracle banking_enterprise_default_managementMatch2.7.1

oracle banking_enterprise_default_managementMatch2.10.0

oracle banking_enterprise_default_managementMatch2.12.0

oracle banking_loans_servicingMatch2.12.0

oracle banking_party_managementMatch2.7.0

oracle banking_platformRange2.3.0–2.4.1

oracle banking_platformMatch2.6.2

oracle banking_platformMatch2.7.1

oracle communications_cloud_native_core_policyMatch1.14.0

oracle communications_network_integrityMatch7.3.6

oracle hospitality_token_proxy_serviceMatch19.2

oracle retail_integration_busMatch19.0.1

oracle retail_order_brokerMatch16.0

oracle retail_service_backboneMatch19.0.1

oracle retail_xstore_office_cloud_serviceMatch16.0.6

oracle retail_xstore_office_cloud_serviceMatch17.0.4

oracle retail_xstore_office_cloud_serviceMatch18.0.3

oracle retail_xstore_office_cloud_serviceMatch19.0.2

oracle retail_xstore_office_cloud_serviceMatch20.0.1

oracle utilities_testing_acceleratorMatch6.0.0.1.1

oracle utilities_testing_acceleratorMatch6.0.0.2.2

oracle utilities_testing_acceleratorMatch6.0.0.3.1

[
  {
    "product": "Apache Velocity Engine",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "2.2",
        "status": "affected",
        "version": "Apache Velocity Engine",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
lists	www.lists.apache.org/thread.html/r3ea4c4c908505b20a4c268330dfe7188b90c84dcf777728d02068ae6%40%3Cannounce.apache.org%3E
oracle	www.oracle.com/security-alerts/cpujan2022.html
lists	www.lists.apache.org/thread.html/r293284c6806c73f51098001ea86a14271c39f72cd76af9e946d9d9ad%40%3Cdev.ws.apache.org%3E
security	www.security.gentoo.org/glsa/202107-52
openwall	www.openwall.com/lists/oss-security/2021/03/10/1
lists	www.lists.apache.org/thread.html/reab5978b54a9f4c078402161e30a89c42807b198814acadbe6c862c7%40%3Cdev.ws.apache.org%3E
lists	www.lists.apache.org/thread.html/r0bc98e9cd080b4a13b905c571b9bed87e1a0878d44dbf21487c6cca4%40%3Cdev.santuario.apache.org%3E
lists	www.lists.apache.org/thread.html/r39de20c7e9c808b1f96790875d33e58c9c0aabb44fd9227e7b3dc5da%40%3Cdev.ws.apache.org%3E
lists	www.lists.apache.org/thread.html/rd2a89e17e8a9b451ce655f1a34117752ea1d18a22ce580d8baa824fd%40%3Ccommits.druid.apache.org%3E
lists	www.lists.apache.org/thread.html/rb042f3b0090e419cc9f5a3d32cf0baff283ccd6fcb1caea61915d6b6%40%3Ccommits.velocity.apache.org%3E

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo

10 Mar 2021 08:15Current

8.9High risk

Vulners AI Score8.9

CVSS29

CVSS38.8

EPSS0.12389