{"id":10035,"date":"2020-02-14T10:05:30","date_gmt":"2020-02-14T10:05:30","guid":{"rendered":"https:\/\/nsfocusglobal.com\/?p=10035"},"modified":"2026-04-17T18:07:50","modified_gmt":"2026-04-17T18:07:50","slug":"fusionauth-remote-code-execution-vulnerability-cve-2020-7799-threat-alert","status":"publish","type":"post","link":"https:\/\/nsfocusglobal.com\/pt-br\/fusionauth-remote-code-execution-vulnerability-cve-2020-7799-threat-alert\/","title":{"rendered":"FusionAuth Remote Code Execution Vulnerability (CVE-2020-7799) Threat Alert"},"content":{"rendered":"


\n<\/p>\n

    \n
  1. \n

    <\/a>Vulnerability Description<\/strong><\/h2>\n<\/li>\n<\/ol>\n

    On January 28, 2019, Beijing time, NVD released a remote command execution vulnerability (CVE-2020-7799) in the Apache Freemarker template in FusionAuth. It is found that an authenticated user can edit email templates (Home > Settings > Email Templates<\/strong>) or themes (Home > Settings > Themes<\/strong>) in FusionAuth to execute arbitrary commands in the underlying operating system by using freemarker.template.utility.Execute in the Apache FreeMarker engine of custom templates.<\/p>\n

    FusionAuth is a modern open-source access management application that can be integrated with multiple technologies and platforms. You can configure and customize FusionAuth in various ways on the dashboard to provide authentication, authorization, and user management functions for any applications. As FusionAuth uses the Apache FreeMarker template engine and fails to properly sanitize user inputs, an attacker could exploit this vulnerability to impose a serious threat to server security. Currently, the vulnerability’s proof of concept (PoC) has been made publicly available and users should take related precautions as soon as possible.<\/p>\n

     <\/p>\n

    For details of this vulnerability, visit the following link:<\/p>\n

    https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2020-7799<\/p>\n

    Scope of Impact<\/strong><\/h2>\n

    Affected Versions<\/strong><\/p>\n