CVE-2020-13942: Apache Unomi OGNL/MVEL injection via public /context.json endpoint

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network-only, unauthenticated access, public exploit material and a very high EPSS score make this an urgent patch target.

What it is

Apache Unomi fails to properly filter OGNL and MVEL expressions submitted to the public /context.json endpoint, allowing script injection. A partial fix in 1.5.1 was bypassed by a new attack vector, and scripts are only completely filtered in 1.5.2. Because the endpoint is public and the flaw is unauthenticated, it is a serious remote code execution risk for exposed Unomi instances.

Impact

An attacker can inject and execute OGNL or MVEL scripts, leading to arbitrary code execution on the Unomi server with the privileges of the application. This gives full compromise of confidentiality, integrity and availability of the host and its data.

Attack surface

Reached over the network through the public /context.json HTTP endpoint with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N. Any internet- or network-exposed Unomi instance running an affected 1.5.x version is reachable.

Exploitation

Not listed in CISA KEV, but EPSS is very high at 0.684 (99.3rd percentile) and a third-party advisory is tagged as containing an exploit, indicating public exploit material exists. No ransomware group usage is documented.

What to do

• Upgrade Apache Unomi to 1.5.2 or the latest available 1.5.x release, which completely filters scripts from input.
• If immediate upgrade is not possible, restrict network access to /context.json so only trusted clients can reach it.
• Place Unomi behind a reverse proxy or WAF and block requests containing OGNL/MVEL expression patterns to the context endpoint.
• Audit for prior compromise and rotate any credentials or secrets stored on or reachable from the Unomi host.
• Monitor vendor and Apache mailing list advisories for further 1.5.x fixes.

Detection

• Inspect HTTP access logs for POST requests to /context.json with OGNL or MVEL syntax in the body, such as expression delimiters and Java class references.
• Alert on unexpected outbound connections or child processes spawned by the Unomi Java process.
• Monitor for unusual file writes or new files in the Unomi application directories.
• Correlate repeated /context.json requests from single source IPs with anomalous payload sizes or encoding.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.