{"api_version":"1","generated_at":"2026-04-23T02:17:16+00:00","cve":"CVE-2020-13959","urls":{"html":"https://cve.report/CVE-2020-13959","api":"https://cve.report/api/cve/CVE-2020-13959.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2020-13959","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2020-13959"},"summary":{"title":"CVE-2020-13959","description":"The default error page for VelocityView in Apache Velocity Tools prior to 3.1 reflects back the vm file that was entered as part of the URL. An attacker can set an XSS payload file as this vm file in the URL which results in this payload being executed. XSS vulnerabilities allow attackers to execute arbitrary JavaScript in the context of the attacked website and the attacked user. This can be abused to steal session cookies, perform requests in the name of the victim or for phishing attacks.","state":"PUBLIC","assigner":"security@apache.org","published_at":"2021-03-10 08:15:00","updated_at":"2023-11-07 03:17:00"},"problem_types":["CWE-79"],"metrics":[],"references":[{"url":"http://www.openwall.com/lists/oss-security/2021/03/10/2","name":"[oss-security] 20210309 CVE-2020-13959: Velocity Tools XSS Vulnerability","refsource":"MLIST","tags":["Mailing List","Third Party Advisory"],"title":"oss-security - CVE-2020-13959: Velocity Tools XSS Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://lists.debian.org/debian-lts-announce/2021/03/msg00021.html","name":"[debian-lts-announce] 20210317 [SECURITY] [DLA 2597-1] velocity-tools security update","refsource":"MLIST","tags":[],"title":"[SECURITY] [DLA 2597-1] velocity-tools security update","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://lists.apache.org/thread.html/r6802a38c3041059e763a1aadd7b37fe95de75408144b5805e29b84e3%40%3Cuser.velocity.apache.org%3E","name":"N/A","refsource":"CONFIRM","tags":["Mailing List","Vendor Advisory"],"title":"Pony Mail!","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://lists.apache.org/thread.html/rf9868c564cff7adfd5283563f2309b93b3e496354a211a57503b2f72@%3Cannounce.apache.org%3E","name":"[announce] 20210310 CVE-2020-13959: Velocity Tools XSS Vulnerability","refsource":"MLIST","tags":["Mailing List","Vendor Advisory"],"title":"Pony Mail!","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://lists.apache.org/thread.html/rf9868c564cff7adfd5283563f2309b93b3e496354a211a57503b2f72%40%3Cannounce.apache.org%3E","name":"[announce] 20210310 CVE-2020-13959: Velocity Tools XSS Vulnerability","refsource":"","tags":[],"title":"Pony Mail!","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://lists.apache.org/thread.html/r97edad0655770342d2d36620fb1de50b142fcd6c4f5c53dd72ca41d7%40%3Cuser.velocity.apache.org%3E","name":"[velocity-user] 20210318 Re: CVE-2020-13959: Velocity Tools XSS Vulnerability","refsource":"","tags":[],"title":"Pony Mail!","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://lists.apache.org/thread.html/rb042f3b0090e419cc9f5a3d32cf0baff283ccd6fcb1caea61915d6b6%40%3Ccommits.velocity.apache.org%3E","name":"[velocity-commits] 20210310 [velocity-site] 01/01: CVE announcement","refsource":"","tags":[],"title":"Pony Mail!","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://lists.apache.org/thread.html/rb042f3b0090e419cc9f5a3d32cf0baff283ccd6fcb1caea61915d6b6@%3Ccommits.velocity.apache.org%3E","name":"[velocity-commits] 20210310 [velocity-site] 01/01: CVE announcement","refsource":"MLIST","tags":["Mailing List","Patch","Vendor Advisory"],"title":"Pony Mail!","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://lists.apache.org/thread.html/r97edad0655770342d2d36620fb1de50b142fcd6c4f5c53dd72ca41d7@%3Cuser.velocity.apache.org%3E","name":"[velocity-user] 20210318 Re: CVE-2020-13959: Velocity Tools XSS Vulnerability","refsource":"MLIST","tags":[],"title":"Pony Mail!","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://security.gentoo.org/glsa/202107-52","name":"GLSA-202107-52","refsource":"GENTOO","tags":[],"title":"Apache Velocity: Multiple vulnerabilities (GLSA 202107-52) — Gentoo security","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://lists.apache.org/thread.html/r6802a38c3041059e763a1aadd7b37fe95de75408144b5805e29b84e3@%3Cuser.velocity.apache.org%3E","name":"[velocity-user] 20210310 CVE-2020-13959: Velocity Tools XSS Vulnerability","refsource":"MLIST","tags":["Mailing List","Vendor Advisory"],"title":"Pony Mail!","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-13959","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13959","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"LEGACY","value":"This issue was reported and a patch was submitted by Jackson Henry, member of Sakura Samurai.","lang":""}],"nvd_cpes":[{"cve_year":"2020","cve_id":"13959","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"apache","cpe5":"velocity_tools","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"13959","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"debian","cpe5":"debian_linux","cpe6":"9.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[{"cve":"CVE-2020-13959","qid":"178495","title":"Debian Security Update for velocity-tools (DLA 2597-1)"},{"cve":"CVE-2020-13959","qid":"199648","title":"Ubuntu Security Notification for Velocity Tools Vulnerability (USN-6282-1)"},{"cve":"CVE-2020-13959","qid":"710043","title":"Gentoo Linux Apache Velocity Multiple Vulnerabilities (GLSA 202107-52)"},{"cve":"CVE-2020-13959","qid":"981991","title":"Java (maven) Security Update for org.apache.velocity:velocity-tools (GHSA-fh63-4r66-jc7v)"}]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"security@apache.org","ID":"CVE-2020-13959","STATE":"PUBLIC","TITLE":"Velocity Tools XSS Vulnerability"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Apache Velocity Tools","version":{"version_data":[{"version_affected":"<","version_name":"Apache Velocity Tools","version_value":"3.1"}]}}]},"vendor_name":"Apache Software Foundation"}]}},"credit":[{"lang":"eng","value":"This issue was reported and a patch was submitted by Jackson Henry, member of Sakura Samurai."}],"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The default error page for VelocityView in Apache Velocity Tools prior to 3.1 reflects back the vm file that was entered as part of the URL. An attacker can set an XSS payload file as this vm file in the URL which results in this payload being executed. XSS vulnerabilities allow attackers to execute arbitrary JavaScript in the context of the attacked website and the attacked user. This can be abused to steal session cookies, perform requests in the name of the victim or for phishing attacks."}]},"generator":{"engine":"Vulnogram 0.0.9"},"impact":[],"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-79 Cross-site Scripting (XSS)"}]}]},"references":{"reference_data":[{"refsource":"MISC","url":"https://lists.apache.org/thread.html/r6802a38c3041059e763a1aadd7b37fe95de75408144b5805e29b84e3%40%3Cuser.velocity.apache.org%3E","name":"https://lists.apache.org/thread.html/r6802a38c3041059e763a1aadd7b37fe95de75408144b5805e29b84e3%40%3Cuser.velocity.apache.org%3E"},{"refsource":"MLIST","name":"[velocity-user] 20210310 CVE-2020-13959: Velocity Tools XSS Vulnerability","url":"https://lists.apache.org/thread.html/r6802a38c3041059e763a1aadd7b37fe95de75408144b5805e29b84e3@%3Cuser.velocity.apache.org%3E"},{"refsource":"MLIST","name":"[velocity-commits] 20210310 [velocity-site] 01/01: CVE announcement","url":"https://lists.apache.org/thread.html/rb042f3b0090e419cc9f5a3d32cf0baff283ccd6fcb1caea61915d6b6@%3Ccommits.velocity.apache.org%3E"},{"refsource":"MLIST","name":"[announce] 20210310 CVE-2020-13959: Velocity Tools XSS Vulnerability","url":"https://lists.apache.org/thread.html/rf9868c564cff7adfd5283563f2309b93b3e496354a211a57503b2f72@%3Cannounce.apache.org%3E"},{"refsource":"MLIST","name":"[oss-security] 20210309 CVE-2020-13959: Velocity Tools XSS Vulnerability","url":"http://www.openwall.com/lists/oss-security/2021/03/10/2"},{"refsource":"MLIST","name":"[debian-lts-announce] 20210317 [SECURITY] [DLA 2597-1] velocity-tools security update","url":"https://lists.debian.org/debian-lts-announce/2021/03/msg00021.html"},{"refsource":"MLIST","name":"[velocity-user] 20210318 Re: CVE-2020-13959: Velocity Tools XSS Vulnerability","url":"https://lists.apache.org/thread.html/r97edad0655770342d2d36620fb1de50b142fcd6c4f5c53dd72ca41d7@%3Cuser.velocity.apache.org%3E"},{"refsource":"GENTOO","name":"GLSA-202107-52","url":"https://security.gentoo.org/glsa/202107-52"}]},"source":{"discovery":"UNKNOWN"},"work_around":[{"lang":"eng","value":"Applications based on Apache Velocity Tools should upgrade to version 3.1.  This version escapes the reflected text on the default error page, preventing potential javascript execution."}]},"nvd":{"publishedDate":"2021-03-10 08:15:00","lastModifiedDate":"2023-11-07 03:17:00","problem_types":["CWE-79"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM"},"exploitabilityScore":2.8,"impactScore":2.7},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE","baseScore":4.3},"severity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:apache:velocity_tools:*:*:*:*:*:*:*:*","versionEndExcluding":"3.1","cpe_name":[]}]},{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2020","CveId":"13959","Ordinal":"175185","Title":"CVE-2020-13959","CVE":"CVE-2020-13959","Year":"2020"},"notes":[{"CveYear":"2020","CveId":"13959","Ordinal":"1","NoteData":"The default error page for VelocityView in Apache Velocity Tools prior to 3.1 reflects back the vm file that was entered as part of the URL. An attacker can set an XSS payload file as this vm file in the URL which results in this payload being executed. XSS vulnerabilities allow attackers to execute arbitrary JavaScript in the context of the attacked website and the attacked user. This can be abused to steal session cookies, perform requests in the name of the victim or for phishing attacks.","Type":"Description","Title":null},{"CveYear":"2020","CveId":"13959","Ordinal":"2","NoteData":"2021-03-10","Type":"Other","Title":"Published"},{"CveYear":"2020","CveId":"13959","Ordinal":"3","NoteData":"2021-07-24","Type":"Other","Title":"Modified"}]}}}