PT-2021-9683 · Apache+2 · Apache Velocity Tools+2

Published 2021-03-10 · Updated 2023-08-10 · CVE-2020-13959

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache Velocity Tools versions prior to 3.1

Description The default error page for VelocityView in Apache Velocity Tools reflects back the vm file that was entered as part of the URL. An attacker can set an XSS payload file as this vm file in the URL, which results in this payload being executed. This allows attackers to execute arbitrary JavaScript in the context of the attacked website and the attacked user, potentially leading to the theft of session cookies, performing requests in the name of the victim, or phishing attacks.

Recommendations For versions prior to 3.1, update to version 3.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the default error page for VelocityView to minimize the risk of exploitation. Avoid using user-inputted vm files in the URL until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-13959

DLA-2597-1

GHSA-FH63-4R66-JC7V

OESA-2021-1122

USN-6282-1

Affected Products

Apache Velocity Tools

Linuxmint

Ubuntu

References · 29

• https://osv.dev/vulnerability/OESA-2021-1122 · Vendor Advisory
• https://security.gentoo.org/glsa/202107-52 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-13959 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-13959 · Vendor Advisory
• https://lists.apache.org/thread.html/r6802a38c3041059e763a1aadd7b37fe95de75408144b5805e29b84e3%40%3Cuser.velocity.apache.org%3E · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-13959 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-13959 · Security Note
• https://osv.dev/vulnerability/CVE-2020-13959 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fh63-4r66-jc7v · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6282-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2597-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-13959 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-13959 · Security Note
• https://osv.dev/vulnerability/USN-6282-1 · Vendor Advisory
• http://openwall.com/lists/oss-security/2021/03/10/2 · Note