Cross-site Scripting (XSS) in Apache ActiveMQ Artemis

MEDIUM 6.1CVE-2020-13932 · GHSA-3h2h-xqr2-2jp7 · Published 20/07/2020 · updated 17/06/2026

In short

CVE-2020-13932 is a MEDIUM (CVSS 6.1) vulnerability affecting org.apache.activemq:apache-artemis, artemis (apache).
Chance of exploitation in the next 30 days (EPSS): 4.3%, higher than 91.2% of all vulnerabilities.
Fix: update to 2.14.0 or later.

Package	Affected versions	Patched versions
org.apache.activemq:apache-artemis Maven	`≥ 2.5.0, < 2.14.0`	`2.14.0`
artemis apache	`≥ 2.5.0, ≤ 2.13.0`	No fix yet

Description

In Apache ActiveMQ Artemis 2.5.0 to 2.13.0, a specially crafted MQTT packet which has an XSS payload as client-id or topic name can exploit this vulnerability. The XSS payload is being injected into the admin console's browser. The XSS payload is triggered in the diagram plugin; queue node and the info section.

NVD description

References

More vulnerabilities in org.apache.activemq:apache-artemis

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free