Log in Start free

Vulnerability · Published Feb 8, 2021 · Assigned by apache

CVE-2020-13947

Medium 6.1

In plain English

A medium-severity security flaw in Apache ActiveMQ. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 79.2% (higher than 99.6% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)6.1Medium
Exploit odds (30 days)79.2%top 0.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the message.jsp page of Apache ActiveMQ versions 5.15.12 through 5.16.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12activemq5.16.1-1DEBIAN-CVE-2020-13947
Debian:13activemq5.16.1-1DEBIAN-CVE-2020-13947
Mavenorg.apache.activemq:activemq-parent5.16.1GHSA-66gw-ch5v-74v8
Mavenorg.apache.activemq:activemq-parent5.15.14GHSA-66gw-ch5v-74v8
Ubuntu:24.04:LTSactivemqno fix listedUBUNTU-CVE-2020-13947
Ubuntu:25.10activemqno fix listedUBUNTU-CVE-2020-13947
Ubuntu:26.04:LTSactivemqno fix listedUBUNTU-CVE-2020-13947
Ubuntu:26.10activemqno fix listedUBUNTU-CVE-2020-13947

Affected products (as reported)

VendorProductVersions
n/a Apache ActiveMQ Apache ActiveMQ version prior to 5.15.13 and 5.16.1

References