CVE-2020-13821

MEDIUM 5.4CVE-2020-13821 · Published 26/08/2020 · updated 17/06/2026

In short

CVE-2020-13821 is a MEDIUM (CVSS 5.4) vulnerability affecting broker control center (hivemq).
Chance of exploitation in the next 30 days (EPSS): 0.53%, higher than 45.2% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
broker control center hivemq	`= 4.3.2`	No fix yet

Description

An issue was discovered in HiveMQ Broker Control Center 4.3.2. A crafted clientid parameter in an MQTT packet (sent to the Broker) is reflected in the client section of the management console. The attacker's JavaScript is loaded in a browser, which can lead to theft of the session and cookie of the administrator's account of the Broker.

References

payatu.com/advisory/hivemq-mqtt-broker---xss-over-mqtt · Third Party Advisory
hivemq.com/blog/hivemq-4-3-3-released · Release Notes

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free