GitHub Advisoryadvisory · Maven

GHSA-3h2h-xqr2-2jp7 Cross-site Scripting (XSS) in Apache ActiveMQ Artemis

MEDIUM Published 2022-02-09 Modified 2026-06-15 Official page ↗
Aliases
CVE-2020-13932
Ecosystem
Maven
Packages
org.apache.activemq:apache-artemis
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2021-04-05

Affected packages

• Maven org.apache.activemq:apache-artemis: >= 2.5.0, < 2.14.0 → fixed in 2.14.0

Description

In Apache ActiveMQ Artemis 2.5.0 to 2.13.0, a specially crafted MQTT packet which has an XSS payload as client-id or topic name can exploit this vulnerability. The XSS payload is being injected into the admin console's browser. The XSS payload is triggered in the diagram plugin; queue node and the info section.

Related

Alias · CVE (1)

  • CVE-2020-13932 In Apache ActiveMQ Artemis 2.5.0 to 2.13.0, a specially crafted MQTT packet which has an XSS payload as client-id or topic name can exploit… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References