CVE-2020-13959

Katalog CVE

CVSS 6.1 · Medium EPSS 5,7%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada apache velocity tools, debian linux. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

The default error page for VelocityView in Apache Velocity Tools prior to 3.1 reflects back the vm file that was entered as part of the URL. An attacker can set an XSS payload file as this vm file in the URL which results in this payload being executed. XSS vulnerabilities allow attackers to execute arbitrary JavaScript in the context of the attacked website and the attacked user. This can be abused to steal session cookies, perform requests in the name of the victim or for phishing attacks.

Rincian

Terbit di NVD

10 Maret 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

5,7% peluang dieksploitasi; lebih tinggi dari 92,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread.html/r6802a38c3041059e763a1aadd7b37fe95de75408144b5805e29b84e3%40%3Cuser.veloc... mailing list · advisory vendor
• http://www.openwall.com/lists/oss-security/2021/03/10/2 mailing list · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2021/03/msg00021.html mailing list · advisory pihak ketiga
• https://security.gentoo.org/glsa/202107-52 advisory pihak ketiga
• https://lists.apache.org/thread.html/r97edad0655770342d2d36620fb1de50b142fcd6c4f5c53dd72ca41d7%40%3Cuser.veloc...
• https://lists.apache.org/thread.html/rb042f3b0090e419cc9f5a3d32cf0baff283ccd6fcb1caea61915d6b6%40%3Ccommits.ve...
• https://lists.apache.org/thread.html/rf9868c564cff7adfd5283563f2309b93b3e496354a211a57503b2f72%40%3Cannounce.a...