CVE-2020-13947 json
Cross-site scripting (XSS) in Apache ActiveMQ
published 2021-02-08 5 y ago modified 2026-09-08 2 mo ago also BIT-activemq-2020-13947 , EUVD-2022-0856 , GHSA-66gw-ch5v-74v8
- cvss
- 6.1
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 79.2%
- EPSS 79.2% chance of exploitation in 30 days, percentile 99.6%
- public exploits
- 0
- none known
Summary
An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the message.jsp page of Apache ActiveMQ versions 5.15.12 through 5.16.0.
Patch / fix
- maven org.apache.activemq:activemq-parent 5.15.14, 5.16.1
- bitnami activemq 5.15.14, 5.16.1
- apache activemq 5.15.14, 5.16.1
- activemq Debian 13, Debian 12 5.16.1-1
debian advisories DEBIAN-CVE-2020-13947
Exploit prediction
79.18% chance of exploitation in the next 30 days, higher than 99.6% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| GitHub | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| NVD | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N |
| OSV | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.activemq:activemq-parent | >=5.16.0, <5.16.1 <5.15.14 |
5.16.1 5.15.14 |
| bitnami | activemq | <5.15.14 >=5.16.0, <5.16.1 |
5.15.14 5.16.1 |
Affected products
- n/a Apache ActiveMQ
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
oracle.com
/security-alerts/cpuoct2021.html
web, patch, third-party-advisory, advisory
-
github.com
/apache/activemq/commit/177eb71c52069712bcc9fe14c70e079cc2671a80
web
-
activemq.apache.org
/security-advisories.data/CVE-2020-13947-announcement.txt
web, vendor-advisory, advisory
-
lists.apache.org
/thread.html/r021c490028f61c8b6f7e38efb98e61693b0cbb6b99b02238c6fc7d66%40%3Ccommits.activemq.apache.org%3E
mailing-list, web
-
lists.apache.org
/thread.html/ra66791f1f2b59fa651a81cec5202acdfbf34c2154fc0ff200301cc1c%40%3Cdev.activemq.apache.org%3E
mailing-list, web
-
lists.apache.org
/thread.html/ra66791f1f2b59fa651a81cec5202acdfbf34c2154fc0ff200301cc1c%40%3Cusers.activemq.apache.org%3E
mailing-list, web
-
oracle.com
/security-alerts/cpuApr2021.html
web, not-applicable, third-party-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2020-13947
advisory, web
-
github.com
/apache/activemq
package
-
github.com
/apache/activemq/compare/activemq-5.16.0...activemq-5.16.1
web
-
lists.apache.org
/thread.html/r021c490028f61c8b6f7e38efb98e61693b0cbb6b99b02238c6fc7d66@%3Ccommits.activemq.apache.org%3E
web
-
lists.apache.org
/thread.html/ra66791f1f2b59fa651a81cec5202acdfbf34c2154fc0ff200301cc1c@%3Cdev.activemq.apache.org%3E
web
-
lists.apache.org
/thread.html/ra66791f1f2b59fa651a81cec5202acdfbf34c2154fc0ff200301cc1c@%3Cusers.activemq.apache.org%3E
web
Sources
- CVE List CVE-2020-13947
- GitHub Advisory GHSA-66gw-ch5v-74v8
- NVD CVE-2020-13947
- OSV BIT-activemq-2020-13947
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.