CVE-2020-13932
MediumCVSS 6.1Exploitation Probability (EPSS)
High risk90th percentile - higher than 90% of all known CVEs
Summary
In Apache ActiveMQ Artemis versions 2.5.0 to 2.13.0, there is an XSS vulnerability that can be exploited through a specially crafted MQTT packet containing an XSS payload in the client-id or topic name. The XSS payload is injected into the admin console's browser.
Risk Assessment
Exploitation of this vulnerability could lead to session hijacking of the administrator and exposure of sensitive information. This poses a threat to the integrity and confidentiality of data within the system.
Recommendation
It is recommended to update Apache ActiveMQ Artemis to the latest version to mitigate this vulnerability. Additionally, monitoring and filtering input data to prevent XSS attacks is advisable.
Original NVD description (English source)
In Apache ActiveMQ Artemis 2.5.0 to 2.13.0, a specially crafted MQTT packet which has an XSS payload as client-id or topic name can exploit this vulnerability. The XSS payload is being injected into the admin console's browser. The XSS payload is triggered in the diagram plugin; queue node and the info section.