{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/unomi--1.5.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:apache:unomi:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2020-13942"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Unomi (\u003c 1.5.2)"],"_cs_severities":["high"],"_cs_tags":["apache-unomi","rce","expression-injection","cve-2020-13942"],"_cs_type":"advisory","_cs_vendors":["Apache"],"content_html":"\u003cp\u003eApache Unomi versions prior to 1.5.2 contain a remote code execution vulnerability (CVE-2020-13942) that allows unauthenticated attackers to execute arbitrary code via malicious MVEL or OGNL expressions. The vulnerability is triggered by sending a crafted request to the /context.json endpoint, specifically targeting the parameterValue field. Publicly available exploit scripts now exist that support remote command execution and reverse shell capabilities.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for full remote code execution on the underlying server, potentially leading to total system compromise, data exfiltration, and lateral movement within the network.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate Apache Unomi to version 1.5.2 or later immediately.\u003c/li\u003e\n\u003cli\u003eImplement strict ingress filtering for the /context.json endpoint to block unauthorized or external access.\u003c/li\u003e\n\u003cli\u003eMonitor web server access logs for anomalous POST requests to /context.json containing expression language syntax (e.g., MVEL, OGNL) or shell metacharacters.\u003c/li\u003e\n\u003cli\u003eDeploy the provided detection rule to identify exploitation attempts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-24T06:08:30Z","date_published":"2026-10-24T06:08:30Z","id":"https://feed.craftedsignal.io/briefs/2026-10-unomi-rce/","summary":"Apache Unomi versions prior to 1.5.2 are vulnerable to remote code execution (RCE) via crafted MVEL or OGNL expressions injected into the /context.json endpoint.","title":"Apache Unomi: Remote Code Execution via MVEL/OGNL Injection (CVE-2020-13942)","url":"https://feed.craftedsignal.io/briefs/2026-10-unomi-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Unomi (\u003c 1.5.2)","version":"https://jsonfeed.org/version/1.1"}