Is CVE-2020-13932 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2020-13932 being exploited in the wild.

How severe is CVE-2020-13932?

Medium severity, with a CVSS score of 6.1, published 9 February 2022.

Which products and versions are affected?

org.apache.activemq:apache-artemis (Maven) >= 2.5.0, < 2.14.0, ECOSYSTEM:introduced=2.5.0,fixed=2.14.0.

Is there a fix for CVE-2020-13932?

Yes. org.apache.activemq:apache-artemis (Maven): upgrade to 2.14.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2020-13932 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2020-13932?

Check whether you run org.apache.activemq:apache-artemis (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2020-13932: Apache ActiveMQ Artemis XSS in admin console diagram plugin

Q: Is there a fix for CVE-2020-13932?

Yes. org.apache.activemq:apache-artemis (Maven): upgrade to 2.14.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2020-13932 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2020-13932?

Check whether you run org.apache.activemq:apache-artemis (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2020-13932 · Severity: medium · CVSS 6.1 · Published 2022-02-09

Apache ActiveMQ Artemis, a high-performance message broker, is vulnerable to a security flaw in its web-based administration console. An attacker can send a malicious message that, when viewed by an administrator, executes unauthorized scripts in their browser. This could allow an attacker to perform actions on behalf of the administrator or access sensitive session information.

Vendors: Maven.

Quick answers

Is CVE-2020-13932 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2020-13932 being exploited in the wild.
How severe is CVE-2020-13932?: Medium severity, with a CVSS score of 6.1, published 9 February 2022.
Which products and versions are affected?: org.apache.activemq:apache-artemis (Maven) >= 2.5.0, < 2.14.0, ECOSYSTEM:introduced=2.5.0,fixed=2.14.0.
Is there a fix for CVE-2020-13932?: Yes. org.apache.activemq:apache-artemis (Maven): upgrade to 2.14.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2020-13932 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2020-13932?: Check whether you run org.apache.activemq:apache-artemis (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

org.apache.activemq:apache-artemis (Maven): upgrade to 2.14.0 or later

# set org.apache.activemq:apache-artemis to 2.14.0 in your pom.xml or build.gradle

Technical details

A stored Cross-Site Scripting (XSS) vulnerability exists in Apache ActiveMQ Artemis versions 2.5.0 through 2.13.0. The vulnerability is rooted in the improper neutralization of input from MQTT packets, specifically within the 'client-id' or 'topic name' fields. An unauthenticated attacker can send a specially crafted MQTT packet to the broker; when an administrator subsequently uses the web console's diagram plugin to view queue nodes or info sections, the payload is executed in their browser context. This allows for session hijacking or unauthorized administrative actions. The issue is resolved in version 2.14.0.

Affected products

Apache ActiveMQ Artemis 2.5.0 to 2.13.0

Identifiers

CVE-2020-13932
GHSA-3h2h-xqr2-2jp7

Timeline

2020-07-20: disclosed: Initial NVD publication
2020-07-20: advisory: Apache security advisory released
2022-02-09: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.