Read the docs
TI-2020-10909 Aliases CVE-2020-13932GHSA-3h2h-xqr2-2jp7

Cross-site scripting in Apache ActiveMQ Artemis

Priority LOW 34CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Partial Red Hat: 1 fixed, 6 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.

Summary

In Apache ActiveMQ Artemis 2.5.0 to 2.13.0, a specially crafted MQTT packet which has an XSS payload as client-id or topic name can exploit this vulnerability. The XSS payload is being injected into the admin console's browser. The XSS payload is triggered in the diagram plugin; queue node and the info section.

Why it matters now

EPSS 0.04347 91st percentileScored 2026-11-07
Fix Partial org.apache.activemq:apache-artemis (Maven): 2.14.0Red Hat: 1 advisoryRed Hat: 1 fixed, 6 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Apache ActiveMQ ArtemisApache ActiveMQ Artemis 2.5.0 to 2.13.0—No fix listedCNA
—org.apache.activemq:apache-artemis (Maven)2.5.0 to before 2.14.02.14.0Patch availableGHSA-3h2h-xqr2-2jp7
  • Apache ActiveMQ Artemis Vendor— Affected Apache ActiveMQ Artemis 2.5.0 to 2.13.0 Fixed in — No fix listed CNA
  • org.apache.activemq:apache-artemis (Maven) Vendor— Affected 2.5.0 to before 2.14.0 Fixed in 2.14.0 Patch available GHSA-3h2h-xqr2-2jp7

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:artemis:*:*:*:*:*:*:*:*2.5.0 – 2.13.0VulnerableApache
  • cpe:2.3:a:apache:artemis:*:*:*:*:*:*:*:* Versions 2.5.0 – 2.13.0 Vulnerable ·Apache

Remediation

  • Fix · GHSA-3h2h-xqr2-2jp7 org.apache.activemq:apache-artemis (Maven) Fixed in 2.14.0 Advisory →

Red Hat 1 advisory

  • RHSA-2020:5365 Released 2020-12-08 · Red Hat rating Moderate
    Red Hat AMQ Broker 7.8 release and security update
    • Red Hat AMQ

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
JBoss Developer Studio 11AffectedNo fix planned: Out of support scope
Red Hat JBoss A-MQ 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Data Grid 7AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse Service Works 6AffectedNo fix planned: Out of support scope
Red Hat Single Sign-On 7AffectedNo fix planned: Will not fix
Red Hat AMQFixed RHSA-2020:5365
Not affected: 6 products
  • Red Hat Decision Manager 7
  • Red Hat Fuse 7
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform Continuous Delivery
  • Red Hat Process Automation 7
  • Red Hat Virtualization 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-13932
  2. 2026-10-03 Alias added: GHSA-3h2h-xqr2-2jp7

References

Advisory 2

Other 6

  • TI-2026-21857 Apache Artemis, Apache ActiveMQ Artemis: Auth bypass for Core downstream federation CVSS 4.0CRITICAL 9.3
  • TI-2023-27710 Apache ActiveMQ Artemis: Authenticated users could perform RCE via Jolokia MBeans CVSS 3.1HIGH 8.8
  • TI-2026-41732 Apache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachment CVSS 3.1CRITICAL 9.8
  • TI-2026-36537 Missing authentication in Apache Artemis CVSS 3.1CRITICAL 9.1
  • TI-2026-47754 Missing authentication in Apache Artemis CVSS 3.1CRITICAL 9.1
  • TI-2021-08067 ActiveMQ: LDAP-Authentication does not verify passwords on servers with anonymous bind CVSS 3.1HIGH 7.5
See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences