vulnerability

Amazon Linux AMI 2: CVE-2020-13936: Security patch for velocity (ALAS-2021-1690)

Try Surface Command

Back to search

Severity	CVSS	Published	Added	Modified
9	(AV:N/AC:L/Au:S/C:C/I:C/A:C)	Mar 10, 2021	Jul 19, 2021	Sep 30, 2022

Severity

CVSS

(AV:N/AC:L/Au:S/C:C/I:C/A:C)

Published

Mar 10, 2021

Added

Jul 19, 2021

Modified

Sep 30, 2022

Description

An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache Velocity Engine versions up to 2.2.

Solutions

amazon-linux-ami-2-upgrade-velocityamazon-linux-ami-2-upgrade-velocity-demoamazon-linux-ami-2-upgrade-velocity-javadocamazon-linux-ami-2-upgrade-velocity-manual

References

AMAZON-AL2/ALAS-2021-1690
CVE-2020-13936
https://attackerkb.com/topics/CVE-2020-13936

NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.

Try it today