CVE-2020-13936
An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache Velocity Engine versions up to 2.2.
Published:Mar 9, 2021
Last Modified:Feb 13, 2025
EPS:Mar 10, 2021
EPSS Score:0.10626
CVSS Score:8.8
Affected Products
Vendor
Product
Action
Vendor
Apache
Product
Velocity Engine
Apache
Velocity Engine
Vendor
Apache
Product
Wss4j
Apache
Wss4j
Vendor
Debian
Product
Debian Linux
Debian
Debian Linux
Vendor
Oracle
Product
Banking Deposits And Lines Of Credit Servicing
Oracle
Banking Deposits And Lines Of Credit Servicing
Vendor
Oracle
Product
Banking Enterprise Default Management
Oracle
Banking Enterprise Default Management
Vendor
Oracle
Product
Banking Loans Servicing
Oracle
Banking Loans Servicing
Vendor
Oracle
Product
Banking Party Management
Oracle
Banking Party Management
Vendor
Oracle
Product
Banking Platform
Oracle
Banking Platform
Vendor
Oracle
Product
Communications Cloud Native Core Policy
Oracle
Communications Cloud Native Core Policy
Vendor
Oracle
Product
Communications Network Integrity
Oracle
Communications Network Integrity
Vendor
Oracle
Product
Hospitality Token Proxy Service
Oracle
Hospitality Token Proxy Service
Vendor
Oracle
Product
Retail Integration Bus
Oracle
Retail Integration Bus
Vendor
Oracle
Product
Retail Order Broker
Oracle
Retail Order Broker
Vendor
Oracle
Product
Retail Service Backbone
Oracle
Retail Service Backbone
Vendor
Oracle
Product
Retail Xstore Office Cloud Service
Oracle
Retail Xstore Office Cloud Service
Vendor
Oracle
Product
Utilities Testing Accelerator
Oracle
Utilities Testing Accelerator
Vendor
Redhat
Product
Camel Quarkus
Redhat
Camel Quarkus
Vendor
Redhat
Product
Integration
Redhat
Integration
Vendor
Redhat
Product
Jboss Enterprise Application Platform
Redhat
Jboss Enterprise Application Platform
Vendor
Redhat
Product
Jboss Enterprise Application Platform Eus
Redhat
Jboss Enterprise Application Platform Eus
Vendor
Redhat
Product
Jboss Fuse
Redhat
Jboss Fuse
Vendor
Redhat
Product
Jbosseapxp
Redhat
Jbosseapxp
Exploits
No exploit reference
Common Weakness Enumeration
Common Attack Pattern Enumeration and Classification (CAPEC)
References
Common Vulnerability Scoring System
Attack Vector
Network
Adjacent
Local
Physical
Privileges Required
None
Low
High
User Interaction
None
Required
Scope
Unchanged
Changed
Confidentiality
None
Low
High
Integrity
None
Low
High
Availability
None
Low
High
