Log in Start free

Vulnerability · Published Mar 10, 2021 · Assigned by apache

CVE-2020-13959Velocity Tools XSS Vulnerability

Medium 6.1

In plain English

A medium-severity cross-site scripting in Apache Velocity Tools from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 5.7% (higher than 93% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)6.1Medium
Exploit odds (30 days)5.7%top 7.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

The default error page for VelocityView in Apache Velocity Tools prior to 3.1 reflects back the vm file that was entered as part of the URL. An attacker can set an XSS payload file as this vm file in the URL which results in this payload being executed. XSS vulnerabilities allow attackers to execute arbitrary JavaScript in the context of the attacked website and the attacked user. This can be abused to steal session cookies, perform requests in the name of the victim or for phishing attacks.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12velocity-tools2.0-8DEBIAN-CVE-2020-13959
Debian:13velocity-tools2.0-8DEBIAN-CVE-2020-13959
Debian:14velocity-tools2.0-8DEBIAN-CVE-2020-13959
Mavenorg.apache.velocity.tools:velocity-tools-parent3.1GHSA-fh63-4r66-jc7v
Mavenorg.apache.velocity:velocity-toolsno fix listedGHSA-fh63-4r66-jc7v

Affected products (as reported)

VendorProductVersions
Apache Software Foundation Apache Velocity Tools Apache Velocity Tools – before 3.1

Weakness: CWE-79

References