CVE-2020-13936

Exploitation

Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.

SSVC decision

Not assessed by CISA

EPSS probability

22.70% probability of exploitation activity in the next 30 days.

EPSS percentile

Equal to or higher than the score of 97.5% of scored records. A rank, not a probability.

NVD base score

8.8 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD analysis status

Modified. NVD last modified this record on 2026-06-17.

Red Hat severity

Important. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

Published

2021-03-10 08:00Z5 YR AGO

Last updated

2025-02-13 16:27Z1 YR AGO

Reserved

2020-06-08

Assigning CNA

apache

Record state

PUBLISHED

Severity

Not rated by the issuing CNA

CNA CVSS vector

Not published by the issuing CNA

Weaknesses

• CWE-94Improper Control of Generation of Code ('Code Injection')Base

Data version

5.1

Document digest

0e67bb3c7a55c3e412b9a7ac4831d7861a74cbe613fde539282a728b7c4adfc4

• lists.apache.orghttps://lists.apache.org/thread.html/r01043f584cbd47959fabe18fff64de940f81a65024bb8dddbda31d9a%40%3Cuser.velocity.apache.org%3Ex_refsource_MISC
• lists.apache.org[velocity-commits] 20210310 [velocity-site] 01/01: CVE announcementhttps://lists.apache.org/thread.html/rb042f3b0090e419cc9f5a3d32cf0baff283ccd6fcb1caea61915d6b6%40%3Ccommits.velocity.apache.org%3Emailing-listx_refsource_MLIST
• www.openwall.com[oss-security] 20210309 CVE-2020-13936: Velocity Sandbox Bypasshttp://www.openwall.com/lists/oss-security/2021/03/10/1mailing-listx_refsource_MLIST
• lists.apache.org[announce] 20210310 CVE-2020-13936: Velocity Sandbox Bypasshttps://lists.apache.org/thread.html/r3ea4c4c908505b20a4c268330dfe7188b90c84dcf777728d02068ae6%40%3Cannounce.apache.org%3Emailing-listx_refsource_MLIST
• lists.apache.org[druid-commits] 20210316 [GitHub] [druid] clintropolis opened a new pull request #11002: suppress CVE check for security fixhttps://lists.apache.org/thread.html/rd2a89e17e8a9b451ce655f1a34117752ea1d18a22ce580d8baa824fd%40%3Ccommits.druid.apache.org%3Emailing-listx_refsource_MLIST
• lists.debian.org[debian-lts-announce] 20210317 [SECURITY] [DLA 2595-1] velocity security updatehttps://lists.debian.org/debian-lts-announce/2021/03/msg00019.htmlmailing-listx_refsource_MLIST
• lists.apache.org[ws-dev] 20210318 [jira] [Commented] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936)https://lists.apache.org/thread.html/re641197d204765130618086238c73dd2ce5a3f94b33785b587d72726%40%3Cdev.ws.apache.org%3Emailing-listx_refsource_MLIST
• lists.apache.org[ws-dev] 20210318 [jira] [Created] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936)https://lists.apache.org/thread.html/rbee7270556f4172322936b5ecc9fabf0c09f00d4fa56c9de1963c340%40%3Cdev.ws.apache.org%3Emailing-listx_refsource_MLIST
• lists.apache.org[ws-dev] 20210319 [jira] [Commented] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936)https://lists.apache.org/thread.html/reab5978b54a9f4c078402161e30a89c42807b198814acadbe6c862c7%40%3Cdev.ws.apache.org%3Emailing-listx_refsource_MLIST
• lists.apache.org[ws-dev] 20210319 [jira] [Comment Edited] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936)https://lists.apache.org/thread.html/rd7e865c87f9043c21d9c1fd9d4df866061d9a08cfc322771160d8058%40%3Cdev.ws.apache.org%3Emailing-listx_refsource_MLIST
• lists.apache.org[ws-dev] 20210322 [jira] [Commented] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936)https://lists.apache.org/thread.html/re8e7482fe54d289fc0229e61cc64947b63b12c3c312e9f25bf6f3b8c%40%3Cdev.ws.apache.org%3Emailing-listx_refsource_MLIST
• lists.apache.org[santuario-dev] 20210323 [GitHub] [santuario-xml-security-java] dependabot[bot] opened a new pull request #33: Bump dependency-check-maven from 6.1.2 to 6.1.3https://lists.apache.org/thread.html/r0bc98e9cd080b4a13b905c571b9bed87e1a0878d44dbf21487c6cca4%40%3Cdev.santuario.apache.org%3Emailing-listx_refsource_MLIST
• lists.apache.org[ws-dev] 20210324 [jira] [Commented] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936)https://lists.apache.org/thread.html/r39de20c7e9c808b1f96790875d33e58c9c0aabb44fd9227e7b3dc5da%40%3Cdev.ws.apache.org%3Emailing-listx_refsource_MLIST
• lists.apache.org[ws-dev] 20210325 [jira] [Updated] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936)https://lists.apache.org/thread.html/r17cb932fab14801b14e5b97a7f05192f4f366ef260c10d4a8dba8ac9%40%3Cdev.ws.apache.org%3Emailing-listx_refsource_MLIST
• lists.apache.org[ws-dev] 20210325 [jira] [Commented] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936)https://lists.apache.org/thread.html/r4cd59453b65d4ac290fcb3b71fdf32b4f1f8989025e89558deb5a245%40%3Cdev.ws.apache.org%3Emailing-listx_refsource_MLIST
• lists.apache.org[turbine-commits] 20210329 svn commit: r1888167 - /turbine/core/trunk/pom.xmlhttps://lists.apache.org/thread.html/r7f209b837217d2a0fe5977fb692e7f15d37fa5de8214bcdc4c21d9a7%40%3Ccommits.turbine.apache.org%3Emailing-listx_refsource_MLIST
• lists.apache.org[ws-dev] 20210331 [jira] [Commented] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936)https://lists.apache.org/thread.html/r293284c6806c73f51098001ea86a14271c39f72cd76af9e946d9d9ad%40%3Cdev.ws.apache.org%3Emailing-listx_refsource_MLIST
• lists.apache.org[ws-dev] 20210401 [jira] [Commented] (WSS-683) WSS4J depends on Velocity 1.7 which contains a security vulnerability (CVE-2020-13936)https://lists.apache.org/thread.html/rf7d369de88dc88a1347006a3323b3746d849234db40a8edfd5ebc436%40%3Cdev.ws.apache.org%3Emailing-listx_refsource_MLIST
• security.gentoo.orgGLSA-202107-52https://security.gentoo.org/glsa/202107-52vendor-advisoryx_refsource_GENTOO
• lists.apache.org[activemq-users] 20210830 Security issueshttps://lists.apache.org/thread.html/r9dc2505651788ac668299774d9e7af4dc616be2f56fdc684d1170882%40%3Cusers.activemq.apache.org%3Emailing-listx_refsource_MLIST
• lists.apache.org[activemq-users] 20210831 RE: Security issueshttps://lists.apache.org/thread.html/r52a5129df402352adc34d052bab9234c8ef63596306506a89fdc7328%40%3Cusers.activemq.apache.org%3Emailing-listx_refsource_MLIST
• www.oracle.comhttps://www.oracle.com/security-alerts/cpujan2022.htmlx_refsource_MISC
• www.oracle.comhttps://www.oracle.com/security-alerts/cpuapr2022.htmlx_refsource_MISC