VDB

CVE-2020-13932

CVE-2020-13932 PUBLISHED CVSS 6.099999904632568 MEDIUM

Reported by apache · Published July 20, 2020

In Apache ActiveMQ Artemis 2.5.0 to 2.13.0, a specially crafted MQTT packet which has an XSS payload as client-id or topic name can exploit this vulnerability. The XSS payload is being injected into the admin console's browser. The XSS payload is triggered in the diagram plugin; queue node and the info section.

Risk Scores

CVSS 3.1
6.099999904632568
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected Products

VendorProductVersions
n/aApache ActiveMQ ArtemisApache ActiveMQ Artemis 2.5.0 to 2.13.0
n/aApache ActiveMQ ArtemisApache ActiveMQ Artemis 2.5.0 to 2.13.0, Apache ActiveMQ Artemis 2.5.0 to 2.13.0, Apache ActiveMQ Artemis 2.5.0 to 2.13.0
Mavenorg.apache.activemq:apache-artemis2.5.0, 2.5.0, 2.5.0

Timeline

  • Jul 20, 2020 CVE Published
  • Apr 14, 2021 EPSS Score
  • Jun 23, 2021 EPSS Score
  • Oct 26, 2021 EPSS Score
  • Dec 27, 2021 EPSS Score
  • Jan 6, 2022 EPSS Score
  • Feb 28, 2022 EPSS Score
  • Apr 1, 2022 EPSS Score
  • May 1, 2022 EPSS Score
  • Sep 4, 2022 EPSS Score
  • Nov 6, 2022 EPSS Score
  • Jan 8, 2023 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›