# CVE-2020-13932: Apache ActiveMQ Artemis XSS in admin console diagram plugin

Source: https://junglewise.ai/threats/cve-2020-13932-apache-activemq-artemis-xss-in-admin-console-diagram-plugin  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-02-09. Updated: 2026-06-15  
License: CC BY 4.0 with a link back

CVE-2020-13932 · Severity: medium · CVSS 6.1 · Published 2022-02-09

Apache ActiveMQ Artemis, a high-performance message broker, is vulnerable to a security flaw in its web-based administration console. An attacker can send a malicious message that, when viewed by an administrator, executes unauthorized scripts in their browser. This could allow an attacker to perform actions on behalf of the administrator or access sensitive session information.

Vendors: [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2020-13932 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2020-13932 being exploited in the wild.

**How severe is CVE-2020-13932?** Medium severity, with a CVSS score of 6.1, published 9 February 2022.

**Which products and versions are affected?** org.apache.activemq:apache-artemis (Maven) >= 2.5.0, < 2.14.0, ECOSYSTEM:introduced=2.5.0,fixed=2.14.0.

**Is there a fix for CVE-2020-13932?** Yes. org.apache.activemq:apache-artemis (Maven): upgrade to 2.14.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2020-13932 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2020-13932?** Check whether you run org.apache.activemq:apache-artemis (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.apache.activemq:apache-artemis (Maven): upgrade to 2.14.0 or later

  ```sh
  # set org.apache.activemq:apache-artemis to 2.14.0 in your pom.xml or build.gradle
  ```


## Technical details

A stored Cross-Site Scripting (XSS) vulnerability exists in Apache ActiveMQ Artemis versions 2.5.0 through 2.13.0. The vulnerability is rooted in the improper neutralization of input from MQTT packets, specifically within the 'client-id' or 'topic name' fields. An unauthenticated attacker can send a specially crafted MQTT packet to the broker; when an administrator subsequently uses the web console's diagram plugin to view queue nodes or info sections, the payload is executed in their browser context. This allows for session hijacking or unauthorized administrative actions. The issue is resolved in version 2.14.0.

## Affected products

- Apache ActiveMQ Artemis 2.5.0 to 2.13.0

## Identifiers

- CVE-2020-13932
- GHSA-3h2h-xqr2-2jp7

## Timeline

- 2020-07-20: disclosed: Initial NVD publication
- 2020-07-20: advisory: Apache security advisory released
- 2022-02-09: advisory: GitHub Advisory published

## References

- [https://activemq.apache.org/security-advisories.data/CVE-2020-13932-announcement.txt](https://activemq.apache.org/security-advisories.data/CVE-2020-13932-announcement.txt)
- [https://lists.apache.org/thread.html/r7fcedcc89e5f296b174d6b8c1438c607c30d809c04292e5732d6e4eb@%3Cusers.activemq.apache.org%3E](https://lists.apache.org/thread.html/r7fcedcc89e5f296b174d6b8c1438c607c30d809c04292e5732d6e4eb@%3Cusers.activemq.apache.org%3E)
- [https://lists.apache.org/thread.html/rb2fd3bf2dce042e0ab3f3c94c4767c96bb2e7e6737624d63162df36d@%3Ccommits.activemq.apache.org%3E](https://lists.apache.org/thread.html/rb2fd3bf2dce042e0ab3f3c94c4767c96bb2e7e6737624d63162df36d@%3Ccommits.activemq.apache.org%3E)
- [https://lists.apache.org/thread.html/rc96ad63f148f784c84ea7f0a178c84a8985c6afccabbcd9847a82088@%3Ccommits.activemq.apache.org%3E](https://lists.apache.org/thread.html/rc96ad63f148f784c84ea7f0a178c84a8985c6afccabbcd9847a82088@%3Ccommits.activemq.apache.org%3E)
- [https://lists.apache.org/thread.html/r7fcedcc89e5f296b174d6b8c1438c607c30d809c04292e5732d6e4eb%40%3Cusers.activemq.apache.org%3E](https://lists.apache.org/thread.html/r7fcedcc89e5f296b174d6b8c1438c607c30d809c04292e5732d6e4eb%40%3Cusers.activemq.apache.org%3E)

## Related threats

- [Improper Authentication in Apache ActiveMQ and Apache Artemis](https://junglewise.ai/threats/cve-2021-26117-improper-authentication-in-apache-activemq-and-apache-artemis)