XSS in Apache Artemis
CVE-2020-13932
In Apache ActiveMQ Artemis 2.5.0 to 2.13.0, a specially crafted MQTT packet which has an XSS payload as client-id or topic name can exploit this vulnerability. The XSS payload is being injected into the admin console's browser. The XSS payload is triggered in the diagram plugin; queue node and the info section.
Vulnerability class: XSS (Cross-Site Scripting)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.
EPSS exploit prediction
EPSS: 0.043 (91.1th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 91st percentile — 91.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.043 · newest: 0.043 · change: 0.000
Affected products
- Apache Artemis
- Apache Activemq Artemis — versions Apache ActiveMQ Artemis 2.5.0 to 2.13.0
Weakness classification (CWE)
References
- activemq.apache.org/security-advisories.data/CVE-2020-13932-announcement.txt (Vendor Advisory)
- lists.apache.org/thread.html/r7fcedcc89e5f296b174d6b8c1438c607c30d809c04292e573… (mailing-list)
- lists.apache.org/thread.html/rc96ad63f148f784c84ea7f0a178c84a8985c6afccabbcd984… (mailing-list)
- lists.apache.org/thread.html/rb2fd3bf2dce042e0ab3f3c94c4767c96bb2e7e6737624d631… (mailing-list)
Frequently asked questions
- What is CVE-2020-13932?
- CVE-2020-13932 is a medium-severity vulnerability in Apache Artemis, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2020-07-20.
- How severe is CVE-2020-13932?
- Medium severity. CVSS v3 base score is 6.1 out of 10.