Apache-Unomi - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/apache-unomi/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 24 Oct 2026 06:08:30 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgApache Unomi: Remote Code Execution via MVEL/OGNL Injection (CVE-2020-13942)https://feed.craftedsignal.io/briefs/2026-10-unomi-rce/Sat, 24 Oct 2026 06:08:30 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-unomi-rce/Apache Unomi versions prior to 1.5.2 are vulnerable to remote code execution (RCE) via crafted MVEL or OGNL expressions injected into the /context.json endpoint.Apache Unomi versions prior to 1.5.2 contain a remote code execution vulnerability (CVE-2020-13942) that allows unauthenticated attackers to execute arbitrary code via malicious MVEL or OGNL expressions. The vulnerability is triggered by sending a crafted request to the /context.json endpoint, specifically targeting the parameterValue field. Publicly available exploit scripts now exist that support remote command execution and reverse shell capabilities.

Impact

Successful exploitation allows for full remote code execution on the underlying server, potentially leading to total system compromise, data exfiltration, and lateral movement within the network.

Recommendation

  • Update Apache Unomi to version 1.5.2 or later immediately.
  • Implement strict ingress filtering for the /context.json endpoint to block unauthorized or external access.
  • Monitor web server access logs for anomalous POST requests to /context.json containing expression language syntax (e.g., MVEL, OGNL) or shell metacharacters.
  • Deploy the provided detection rule to identify exploitation attempts.
]]>highadvisoryapache-unomirceexpression-injectioncve-2020-13942