CVE-2020-13936 @ Maven-org.apache.velocity:velocity-engine-core-2.0

[cxronen]

Vulnerable Package issue exists @ Maven-org.apache.velocity:velocity-engine-core-2.0 in branch main

An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache Velocity Engine versions up to 2.2.

Namespace: cxronen
Repository: AST_BookStore
Repository Url: https://github.com/cxronen/AST_BookStore
CxAST-Project: cxronen/AST_BookStore
CxAST platform scan: 5ce0a2a6-b532-4da0-8561-73b2e9eca97e
Branch: main
Application: AST_BookStore
Severity: HIGH
State: NOT_IGNORED
Status: RECURRENT
CWE: CWE-94

---

Additional Info
Attack vector: NETWORK
Attack complexity: LOW
Confidentiality impact: HIGH
Availability impact: HIGH
Remediation Upgrade Recommendation: 2.3

---

References
Advisory
Disclosure
Pull request
Commit