CVE-2020-13932

In Apache ActiveMQ Artemis 2.5.0 to 2.13.0, a specially crafted MQTT packet which has an XSS payload as client-id or topic name can exploit this vulnerability. The XSS payload is being injected into the admin console's browser. The XSS payload is triggered in the diagram plugin; queue node and the info section.

• CWE-79

• https://activemq.apache.org/security-advisories.data/CVE-2020-13932-announcement.txtVendor Advisory
• https://lists.apache.org/thread.html/r7fcedcc89e5f296b174d6b8c1438c607c30d809c04292e5732d6e4eb%40%3Cusers.activemq.apache.org%3E
• https://lists.apache.org/thread.html/rb2fd3bf2dce042e0ab3f3c94c4767c96bb2e7e6737624d63162df36d%40%3Ccommits.activemq.apache.org%3E
• https://lists.apache.org/thread.html/rc96ad63f148f784c84ea7f0a178c84a8985c6afccabbcd9847a82088%40%3Ccommits.activemq.apache.org%3E
• https://activemq.apache.org/security-advisories.data/CVE-2020-13932-announcement.txtVendor Advisory
• https://lists.apache.org/thread.html/r7fcedcc89e5f296b174d6b8c1438c607c30d809c04292e5732d6e4eb%40%3Cusers.activemq.apache.org%3E
• https://lists.apache.org/thread.html/rb2fd3bf2dce042e0ab3f3c94c4767c96bb2e7e6737624d63162df36d%40%3Ccommits.activemq.apache.org%3E
• https://lists.apache.org/thread.html/rc96ad63f148f784c84ea7f0a178c84a8985c6afccabbcd9847a82088%40%3Ccommits.activemq.apache.org%3E

Published

Jul 20, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-13926Kylin concatenates and executes a Hive SQL in Hive CLI or be…9.8
• CVE-2020-13927The previous default setting for Airflow's Experimental API …9.8
• CVE-2020-13928Apache Atlas before 2.1.0 contain a XSS vulnerability. While…6.1
• CVE-2020-13929Authentication bypass vulnerability in Apache Zeppelin allow…7.5
• CVE-2020-1393An elevation of privilege vulnerability exists when the Wind…7.8
• CVE-2020-13931If Apache TomEE 8.0.0-M1 - 8.0.3, 7.1.0 - 7.1.3, 7.0.0-M1 - …9.8
• CVE-2020-13933Apache Shiro before 1.6.0, when using Apache Shiro, a specia…7.5
• CVE-2020-13934An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.…7.5
• CVE-2020-13935The payload length in a WebSocket frame was not correctly va…7.5
• CVE-2020-13936An attacker that is able to modify Velocity templates may ex…8.8
• CVE-2020-13937Apache Kylin 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0…5.3
• CVE-2020-13938Apache HTTP Server versions 2.4.0 to 2.4.46 Unprivileged loc…5.5