Read the docs
TI-2020-10935 Aliases CVE-2020-13959GHSA-fh63-4r66-jc7v

Velocity Tools XSS Vulnerability

Priority LOW 36CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Partial Red Hat: 6 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.

Summary

The default error page for VelocityView in Apache Velocity Tools prior to 3.1 reflects back the vm file that was entered as part of the URL. An attacker can set an XSS payload file as this vm file in the URL which results in this payload being executed. XSS vulnerabilities allow attackers to execute arbitrary JavaScript in the context of the attacked website and the attacked user. This can be abused to steal session cookies, perform requests in the name of the victim or for phishing attacks.

Why it matters now

EPSS 0.05702 93rd percentileScored 2026-11-07
Fix Partial Apache Velocity Tools (Apache Software Foundation): 3.1org.apache.velocity.tools:velocity-tools-parent (Maven): 3.1Red Hat: 6 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Velocity ToolsApache Velocity Tools to before 3.13.1Patch availableCNA
—org.apache.velocity.tools:velocity-tools-parent (Maven)before 3.13.1Patch availableGHSA-fh63-4r66-jc7v
—org.apache.velocity:velocity-tools (Maven)up to 2.0—No fix listedGHSA-fh63-4r66-jc7v
  • Apache Velocity Tools VendorApache Affected Apache Velocity Tools to before 3.1 Fixed in 3.1 Patch available CNA
  • org.apache.velocity.tools:velocity-tools-parent (Maven) Vendor— Affected before 3.1 Fixed in 3.1 Patch available GHSA-fh63-4r66-jc7v
  • org.apache.velocity:velocity-tools (Maven) Vendor— Affected up to 2.0 Fixed in — No fix listed GHSA-fh63-4r66-jc7v

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:apache:velocity_tools:*:*:*:*:*:*:*:*before 3.1VulnerableApache
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
  • cpe:2.3:a:apache:velocity_tools:*:*:*:*:*:*:*:* Versions before 3.1 Vulnerable ·Apache
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian

Remediation

  • Fix · CNA Apache Velocity Tools (Apache Software Foundation) Fixed in 3.1
  • Fix · GHSA-fh63-4r66-jc7v org.apache.velocity.tools:velocity-tools-parent (Maven) Fixed in 3.1 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat BPM Suite 6AffectedNo fix planned: Out of support scope
Red Hat JBoss BRMS 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Data Virtualization 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse Service Works 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Operations Network 3AffectedNo fix planned: Out of support scope
Not affected: 13 products
  • A-MQ Clients 2
  • Red Hat Decision Manager 7
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Fuse 7
  • Red Hat Integration Camel K 1
  • Red Hat JBoss A-MQ 6
  • Red Hat JBoss Fuse 6
  • Red Hat OpenShift Container Platform 3.11
  • Red Hat OpenShift Container Platform 4
  • Red Hat Process Automation 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-13959
  2. 2026-10-03 Alias added: GHSA-fh63-4r66-jc7v

References

Advisory 5

Other 7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences