{"cve":"CVE-2020-13936","nvd":{"published":"2021-03-10T08:15:14.103","modified":"2026-06-17T02:53:56.030","status":"Modified","description":"An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache Velocity Engine versions up to 2.2.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8},"cwes":[],"references":["http://www.openwall.com/lists/oss-security/2021/03/10/1","https://lists.apache.org/thread.html/r01043f584cbd47959fabe18fff64de940f81a65024bb8dddbda31d9a%40%3Cuser.velocity.apache.org%3E","https://lists.apache.org/thread.html/r01043f584cbd47959fabe18fff64de940f81a65024bb8dddbda31d9a%40%3Cuser.velocity.apache.org%3E","https://lists.apache.org/thread.html/r01043f584cbd47959fabe18fff64de940f81a65024bb8dddbda31d9a%40%3Cuser.velocity.apache.org%3E","https://lists.apache.org/thread.html/r01043f584cbd47959fabe18fff64de940f81a65024bb8dddbda31d9a%40%3Cuser.velocity.apache.org%3E"],"products":["apache:velocity_engine","apache:wss4j","debian:debian_linux","oracle:banking_deposits_and_lines_of_credit_servicing","oracle:banking_enterprise_default_management","oracle:banking_loans_servicing","oracle:banking_party_management","oracle:banking_platform","oracle:communications_cloud_native_core_policy","oracle:communications_network_integrity","oracle:hospitality_token_proxy_service","oracle:retail_integration_bus","oracle:retail_order_broker","oracle:retail_service_backbone","oracle:retail_xstore_office_cloud_service","oracle:utilities_testing_accelerator"],"source":"nvd","synced_at":"2026-10-19T21:15:50.279857260+00:00"},"epss":{"cve":"CVE-2020-13936","score":0.22709,"percentile":0.97726,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-59j4-wjwp-mw9m","url":"https://osv.dev/vulnerability/GHSA-59j4-wjwp-mw9m","summary":"Sandbox Bypass in Apache Velocity Engine","modified":"2024-03-15T05:20:53.420286Z","packages":[{"ecosystem":"Maven","name":"org.apache.velocity:velocity-engine-parent","purl":"pkg:maven/org.apache.velocity/velocity-engine-parent","ranges":["<2.3"],"fixed":["2.3"]},{"ecosystem":"Maven","name":"org.apache.velocity:velocity","purl":"pkg:maven/org.apache.velocity/velocity","ranges":["<=1.7"],"fixed":[]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}