UBUNTU-CVE-2020-13959

    Dashboard / Vulnerabilities / UBUNTU-CVE-2020-13959

    UBUNTU-CVE-2020-13959

    Published: 10 Mar 2021Last Modified: 4 Feb 2026
    Upstream:
    CVE-2020-13959
    Aliases:
    USN-6282-1

    Summary:

    Details: The default error page for VelocityView in Apache Velocity Tools prior to 3.1 reflects back the vm file that was entered as part of the URL. An attacker can set an XSS payload file as this vm file in the URL which results in this payload being executed. XSS vulnerabilities allow attackers to execute arbitrary JavaScript in the context of the attacked website and the attacked user. This can be abused to steal session cookies, perform requests in the name of the victim or for phishing attacks.

    References: https://ubuntu.com/security/CVE-2020-13959, https://www.openwall.com/lists/oss-security/2021/03/10/2, http://www.openwall.com/lists/oss-security/2021/03/10/2, https://lists.apache.org/thread.html/r6802a38c3041059e763a1aadd7b37fe95de75408144b5805e29b84e3%40%3Cuser.velocity.apache.org%3E, https://lists.apache.org/thread.html/r6802a38c3041059e763a1aadd7b37fe95de75408144b5805e29b84e3@%3Cuser.velocity.apache.org%3E, https://lists.apache.org/thread.html/rb042f3b0090e419cc9f5a3d32cf0baff283ccd6fcb1caea61915d6b6@%3Ccommits.velocity.apache.org%3E, https://lists.apache.org/thread.html/rf9868c564cff7adfd5283563f2309b93b3e496354a211a57503b2f72@%3Cannounce.apache.org%3E, https://ubuntu.com/security/notices/USN-6282-1, https://www.cve.org/CVERecord?id=CVE-2020-13959

    Affected packages

    Package

    Name: velocity-tools

    Purl: pkg:deb/ubuntu/[email protected]~esm1?arch=source&distro=esm-apps/xenial

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -2.0-4ubuntu0.1~esm1

    Affected versions

    2.0-3

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    UBUNTU-CVE-2020-13959 | CVE-DB