Vulnerability · Published May 14, 2020 · Assigned by apache
CVE-2020-1941
Medium 6.1
In plain English
A medium-severity security flaw in Apache ActiveMQ. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 7.1% (higher than 94% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)6.1Medium
Exploit odds (30 days)7.1%top 5.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
In Apache ActiveMQ 5.0.0 to 5.15.11, the webconsole admin GUI is open to XSS, in the view that lists the contents of a queue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | activemq | 5.16.0-1 | DEBIAN-CVE-2020-1941 |
| Debian:13 | activemq | 5.16.0-1 | DEBIAN-CVE-2020-1941 |
| Maven | org.apache.activemq:activemq-web-console | 5.15.12 | GHSA-cc94-3v9c-7rm8 |
| Ubuntu:24.04:LTS | activemq | no fix listed | UBUNTU-CVE-2020-1941 |
| Ubuntu:25.10 | activemq | no fix listed | UBUNTU-CVE-2020-1941 |
| Ubuntu:26.04:LTS | activemq | no fix listed | UBUNTU-CVE-2020-1941 |
| Ubuntu:26.10 | activemq | no fix listed | UBUNTU-CVE-2020-1941 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | Apache ActiveMQ | Apache ActiveMQ 5.0.0 to 5.15.11 |
References
- https://www.oracle.com/security-alerts/cpujul2020.html x_refsource_MISC
- http://activemq.apache.org/security-advisories.data/CVE-2020-1941-announcement.txt x_refsource_MISC
- [activemq-commits] 20200910 [activemq-website] branch master updated: Publish CVE-2020-11998 mailing-list, x_refsource_MLIST
- https://www.oracle.com/security-alerts/cpuoct2020.html x_refsource_MISC
- [activemq-commits] 20210127 [activemq-website] branch master updated: Publish CVE-2021-26117 mailing-list, x_refsource_MLIST
- [activemq-commits] 20210208 [activemq-website] branch master updated: Publish CVE-2020-13947 mailing-list, x_refsource_MLIST
- https://www.oracle.com/security-alerts/cpuApr2021.html x_refsource_MISC
- https://www.oracle.com//security-alerts/cpujul2021.html x_refsource_MISC