CVE-2020-13959

The default error page for VelocityView in Apache Velocity Tools prior to 3.1 reflects back the vm file that was entered as part of the URL. An attacker can set an XSS payload file as this vm file in the URL which results in this payload being executed. XSS vulnerabilities allow attackers to execute arbitrary JavaScript in the context of the attacked website and the attacked user. This can be abused to steal session cookies, perform requests in the name of the victim or for phishing attacks.

• CWE-79
• CWE-79

• http://www.openwall.com/lists/oss-security/2021/03/10/2Mailing List, Third Party Advisory
• https://lists.apache.org/thread.html/r6802a38c3041059e763a1aadd7b37fe95de75408144b5805e29b84e3%40%3Cuser.velocity.apache.org%3EMailing List, Vendor Advisory
• https://lists.apache.org/thread.html/r6802a38c3041059e763a1aadd7b37fe95de75408144b5805e29b84e3%40%3Cuser.velocity.apache.org%3EMailing List, Vendor Advisory
• https://lists.apache.org/thread.html/r6802a38c3041059e763a1aadd7b37fe95de75408144b5805e29b84e3%40%3Cuser.velocity.apache.org%3EMailing List, Vendor Advisory
• https://lists.apache.org/thread.html/r6802a38c3041059e763a1aadd7b37fe95de75408144b5805e29b84e3%40%3Cuser.velocity.apache.org%3EMailing List, Vendor Advisory
• https://lists.apache.org/thread.html/r97edad0655770342d2d36620fb1de50b142fcd6c4f5c53dd72ca41d7%40%3Cuser.velocity.apache.org%3E
• https://lists.apache.org/thread.html/rb042f3b0090e419cc9f5a3d32cf0baff283ccd6fcb1caea61915d6b6%40%3Ccommits.velocity.apache.org%3E
• https://lists.apache.org/thread.html/rf9868c564cff7adfd5283563f2309b93b3e496354a211a57503b2f72%40%3Cannounce.apache.org%3E
• https://lists.debian.org/debian-lts-announce/2021/03/msg00021.htmlMailing List, Third Party Advisory
• https://security.gentoo.org/glsa/202107-52Third Party Advisory
• http://www.openwall.com/lists/oss-security/2021/03/10/2Mailing List, Third Party Advisory
• https://lists.apache.org/thread.html/r6802a38c3041059e763a1aadd7b37fe95de75408144b5805e29b84e3%40%3Cuser.velocity.apache.org%3EMailing List, Vendor Advisory
• https://lists.apache.org/thread.html/r6802a38c3041059e763a1aadd7b37fe95de75408144b5805e29b84e3%40%3Cuser.velocity.apache.org%3EMailing List, Vendor Advisory
• https://lists.apache.org/thread.html/r6802a38c3041059e763a1aadd7b37fe95de75408144b5805e29b84e3%40%3Cuser.velocity.apache.org%3EMailing List, Vendor Advisory
• https://lists.apache.org/thread.html/r6802a38c3041059e763a1aadd7b37fe95de75408144b5805e29b84e3%40%3Cuser.velocity.apache.org%3EMailing List, Vendor Advisory
• https://lists.apache.org/thread.html/r97edad0655770342d2d36620fb1de50b142fcd6c4f5c53dd72ca41d7%40%3Cuser.velocity.apache.org%3E
• https://lists.apache.org/thread.html/rb042f3b0090e419cc9f5a3d32cf0baff283ccd6fcb1caea61915d6b6%40%3Ccommits.velocity.apache.org%3E
• https://lists.apache.org/thread.html/rf9868c564cff7adfd5283563f2309b93b3e496354a211a57503b2f72%40%3Cannounce.apache.org%3E
• https://lists.debian.org/debian-lts-announce/2021/03/msg00021.htmlMailing List, Third Party Advisory
• https://security.gentoo.org/glsa/202107-52Third Party Advisory

Published

Mar 10, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-13953In Apache Tapestry from 5.4.0 to 5.5.0, crafting specific UR…5.3
• CVE-2020-13954By default, Apache CXF creates a /services page containing a…6.1
• CVE-2020-13955HttpUtils#getURLConnection method disables explicitly hostna…5.9
• CVE-2020-13956Apache HttpClient versions prior to version 4.5.13 and 5.0.3…5.3
• CVE-2020-13957Apache Solr versions 6.6.0 to 6.6.6, 7.0.0 to 7.7.3 and 8.0.…9.8
• CVE-2020-13958A vulnerability in Apache OpenOffice scripting events allows…7.8
• CVE-2020-1396An elevation of privilege vulnerability exists when Windows …7.8
• CVE-2020-13960D-Link DSL 2730-U IN_1.10 and IN_1.11 and DIR-600M 3.04 devi…7.5
• CVE-2020-13961Strapi before 3.0.2 could allow a remote authenticated attac…6.5
• CVE-2020-13962Qt 5.12.2 through 5.14.2, as used in unofficial builds of Mu…7.5
• CVE-2020-13963SOPlanning before 1.47 has Incorrect Access Control because …9.8
• CVE-2020-13964An issue was discovered in Roundcube Webmail before 1.3.12 a…6.1