CVE-2020-13932

In Apache ActiveMQ Artemis 2.5.0 to 2.13.0, a specially crafted MQTT packet which has an XSS payload as client-id or topic name can exploit this vulnerability

published July 20, 2020

CVSS
—
EPSS
4%
Percentile
91.2
In the wild
Unconfirmed
What it is

In Apache ActiveMQ Artemis 2.5.0 to 2.13.0, a specially crafted MQTT packet which has an XSS payload as client-id or topic name can exploit this vulnerability. The XSS payload is being injected into the admin console's browser. The XSS payload is triggered in the diagram plugin; queue node and the info section.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.04347 · 91.2th percentile
Published
2020-07-20T21:08Z
EPSS history
Timeline
  • 20 JUL 21:08Z
    In Apache ActiveMQ Artemis 2.5.0 to 2.13.0, a specially crafted MQTT packet which has an XSS payload as client-id or topic name can exploit this vulnerability
    cvelistv5