CVE-2020-14987

7.2 highEPSS 3.6%

High (7.2) in bloomreach experience manager. EPSS 3.6% chance of exploitation in the next 30 days.

An issue was discovered in Bloomreach Experience Manager (brXM) 4.1.0 through 14.2.2. It allows remote attackers to execute arbitrary code because there is a mishandling of the capability for administrators to write and run Groovy scripts within the updater editor. An attacker must use an AST transforming annotation such as @Grab.

Severity

CVSS 3.1

7.2 high

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS: 3.6% chance of exploitation in the next 30 days; higher than 89% of CVEs (scores of 2026-10-31)
CWEs: CWE-74, CWE-862
Published: 2021-03-11
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

bloomreach:experience_manager

References

https://tvrbk.github.io/cve/2021/03/09/brXM.html
https://tvrbk.github.io/cve/2021/03/09/brXM.html

Check your stack JSON