CVE-2020-13936
high-risk
Published 2021-03-10
An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache Velocity Engine versions up to 2.2.
Do I need to act?
!
16.4% chance of exploitation in next 30 days
EPSS score — higher than 84% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.8/10
High
NETWORK
/ LOW complexity
Affected Products (20)
Banking Party Management
References (48)
and 28 more references
65
/ 100
high-risk
Severity
30/34 · Critical
Exploitability
13/34 · Low
Exposure
22/34 · High