CVE-2020-13959: Cross-site scripting (XSS) in Apache Velocity Tools
Summary
CVE-2020-13959: Cross-site scripting (XSS) in Apache Velocity Tools. Affects org.apache.velocity.tools:velocity-tools-parent versions < 3.1. Fixed in 3.1. How to fix ↓
Also tracked for
- velocity-tools · Debian:11
The same CVE-2020-13959 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Velocity Tools is a collection of Java libraries and tools for the Apache Velocity Template Engine. It provides additional functionality and utilities to enhance the capabilities of Velocity. The vulnerability in question affects the VelocityView component of Apache Velocity Tools. VelocityView is responsible for rendering Velocity templates and handling errors. This vulnerability allows for cross-site scripting (XSS) attacks, which can lead to the execution of arbitrary JavaScript code in the context of the targeted website and user. This can result in the theft of session cookies, unauthorized requests, and phishing attacks.
Vulnerability Detail
The default error page for VelocityView in Apache Velocity Tools prior to version 3.1 reflects back the vm file that was entered as part of the URL. An attacker can exploit this by setting an XSS payload file as the vm file in the URL, causing the payload to be executed. This vulnerability is categorized as CWE-79, which is a weakness related to improper neutralization of input during web page generation. The severity of this vulnerability is rated as MODERATE with a CVSS score of 6.1.
How To Fix
Minimum fixed version
3.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the fix by upgrading to the patched version of Apache Velocity Tools.
Conclusion
The XSS vulnerability in Apache Velocity Tools can have serious consequences, allowing attackers to execute arbitrary JavaScript code in the context of the targeted website and user. To mitigate this risk, it is crucial to upgrade to Apache Velocity Tools version 3.1 or later. By doing so, you can ensure that your application is protected against this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.velocity.tools:velocity-tools-parent →
FAQ
Apache Velocity Tools is a collection of Java libraries and tools that enhance the functionality of the Apache Velocity Template Engine.
This vulnerability allows for cross-site scripting (XSS) attacks, which can lead to the execution of arbitrary JavaScript code in the context of the targeted website and user. This can result in the theft of session cookies, unauthorized requests, and phishing attacks.
The severity of this vulnerability is rated as MODERATE with a CVSS score of 6.1.
To fix this vulnerability, it is recommended to upgrade to Apache Velocity Tools version 3.1 or later. Update your project's dependencies to use the latest version of org.apache.velocity.tools:velocity-tools-parent or org.apache.velocity:velocity-tools.
There is no known workaround for this vulnerability. It is essential to apply the fix by upgrading to the patched version of Apache Velocity Tools.
