CVSS 8.8 · High EPSS 22,7%
Kerentanan pada apache velocity engine, apache wss4j +14 lainnya. Skor CVSS 3.1 8.8 (High) menurut NVD.
An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache Velocity Engine versions up to 2.2.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
· uraikan di kalkulator | Vendor | Produk | Versi terdampak |
|---|---|---|
| apache | velocity engine | Semua versi sebelum 2.3 |
| apache | wss4j | Versi 2.3.1 |
| debian | debian linux | Versi 9.0 |
| oracle | banking deposits and lines of credit servicing | Versi 2.12.0 |
| oracle | banking enterprise default management | Versi 2.3.0 hingga 2.4.1 |
| oracle | banking enterprise default management | Versi 2.6.2 |
| oracle | banking enterprise default management | Versi 2.7.1 |
| oracle | banking enterprise default management | Versi 2.10.0 |
| oracle | banking enterprise default management | Versi 2.12.0 |
| oracle | banking loans servicing | Versi 2.12.0 |
| oracle | banking party management | Versi 2.7.0 |
| oracle | banking platform | Versi 2.3.0 hingga 2.4.1 |
| oracle | banking platform | Versi 2.6.2 |
| oracle | banking platform | Versi 2.7.1 |
| oracle | communications cloud native core policy | Versi 1.14.0 |
| oracle | communications network integrity | Versi 7.3.6 |
| oracle | hospitality token proxy service | Versi 19.2 |
| oracle | retail integration bus | Versi 19.0.1 |
| oracle | retail order broker | Versi 16.0 |
| oracle | retail service backbone | Versi 19.0.1 |
| oracle | retail xstore office cloud service | Versi 16.0.6 |
| oracle | retail xstore office cloud service | Versi 17.0.4 |
| oracle | retail xstore office cloud service | Versi 18.0.3 |
| oracle | retail xstore office cloud service | Versi 19.0.2 |
| oracle | retail xstore office cloud service | Versi 20.0.1 |
| oracle | utilities testing accelerator | Versi 6.0.0.1.1 |
| oracle | utilities testing accelerator | Versi 6.0.0.2.2 |
| oracle | utilities testing accelerator | Versi 6.0.0.3.1 |