CVE-2020-13959
Velocity Tools XSS Vulnerability
The default error page for VelocityView in Apache Velocity Tools prior to 3.1 reflects back the vm file that was entered as part of the URL. An attacker can set an XSS payload file as this vm file in the URL which results in this payload being executed. XSS vulnerabilities allow attackers to execute arbitrary JavaScript in the context of the attacked website and the attacked user. This can be abused to steal session cookies, perform requests in the name of the victim or for phishing attacks.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
The default error page for VelocityView in Apache Velocity Tools prior to 3.1 reflects back the vm file that was entered as part of the URL. An attacker can set an XSS payload file as this vm file in the URL which results in this payload being executed. XSS vulnerabilities allow attackers to execute arbitrary JavaScript in the context of the attacked website and the attacked user. This can be abused to steal session cookies, perform requests in the name of the victim or for phishing attacks.
- Record
CVE-2020-13959- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Velocity Tools XSS Vulnerability
The default error page for VelocityView in Apache Velocity Tools prior to 3.1 reflects back the vm file that was entered as part of the URL. An attacker can set an XSS payload file as this vm file in the URL which results in this payload being executed. XSS vulnerabilities allow attackers to execute arbitrary JavaScript in the context of the attacked website and the attacked user. This can be abused to steal session cookies, perform requests in the name of the victim or for phishing attacks.
- Record
CVE-2020-13959- Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2021-0652
The default error page for VelocityView in Apache Velocity Tools prior to 3.1 reflects back the vm file that was entered as part of the URL. An attacker can set an XSS payload file as this vm file in the URL which results in this payload being executed. XSS vulnerabilities allow attackers to execute arbitrary JavaScript in the context of the attacked website and the attacked user. This can be abused to steal session cookies, perform requests in the name of the victim or for phishing attacks.
- Record
EUVD-2021-0652- CVSS
- 0.0 None
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fh63-4r66-jc7v
Cross-site scripting (XSS) in Apache Velocity Tools
The default error page for VelocityView in Apache Velocity Tools prior to 3.1 reflects back the vm file that was entered as part of the URL. An attacker can set an XSS payload file as this vm file in the URL which results in this payload being executed. XSS vulnerabilities allow attackers to execute arbitrary JavaScript in the context of the attacked website and the attacked user. This can be abused to steal session cookies, perform requests in the name of the victim or for phishing attacks.
- Record
GHSA-fh63-4r66-jc7v- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
The default error page for VelocityView in Apache Velocity Tools prior to 3.1 reflects back the vm file that was entered as part of the URL. An attacker can set an XSS payload file as this vm file in the URL which results in this payload being executed. XSS vulnerabilities allow attackers to execute arbitrary JavaScript in the context of the attacked website and the attacked user. This can be abused to steal session cookies, perform requests in the name of the victim or for phishing attacks.
- Record
CVE-2020-13959- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-13959
The default error page for VelocityView in Apache Velocity Tools prior to 3.1 reflects back the vm file that was entered as part of the URL. An attacker can set an XSS payload file as this vm file in the URL which results in this payload being executed. XSS vulnerabilities allow attackers to execute arbitrary JavaScript in the context of the attacked website and the attacked user. This can be abused to steal session cookies, perform requests in the name of the victim or for phishing attacks.
- Record
DEBIAN-CVE-2020-13959- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
Show 5 moreShow less
OSVGHSA-fh63-4r66-jc7v
Cross-site scripting (XSS) in Apache Velocity Tools
The default error page for VelocityView in Apache Velocity Tools prior to 3.1 reflects back the vm file that was entered as part of the URL. An attacker can set an XSS payload file as this vm file in the URL which results in this payload being executed. XSS vulnerabilities allow attackers to execute arbitrary JavaScript in the context of the attacked website and the attacked user. This can be abused to steal session cookies, perform requests in the name of the victim or for phishing attacks.
- Record
GHSA-fh63-4r66-jc7v- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVOESA-2021-1122
velocity-tools security update
The VelocityTools project is a collection of useful Java classes (aka tools), as well as infrastructure to easily, automatically and transparently make these tools available to Velocity templates. Project include easy integration of Velocity into the view-layer of web applications (via the VelocityViewTag and VelocityViewServlet) and integration with Struts 1.x applications.
Security Fix(es):
The default error page for VelocityView in Apache Velocity Tools prior to 3.1 reflects back the vm file that was entered as part of the URL. An attacker can set an XSS payload file as this vm file in the URL which results in this payload being executed. XSS vulnerabilities allow attackers to execute arbitrary JavaScript in the context of the attacked website and the attacked user. This can be abused to steal session cookies, perform requests in the name of the victim or for phishing attacks.(CVE-2020-13959)
- Record
OESA-2021-1122- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-13959
The default error page for VelocityView in Apache Velocity Tools prior to 3.1 reflects back the vm file that was entered as part of the URL. An attacker can set an XSS payload file as this vm file in the URL which results in this payload being executed. XSS vulnerabilities allow attackers to execute arbitrary JavaScript in the context of the attacked website and the attacked user. This can be abused to steal session cookies, perform requests in the name of the victim or for phishing attacks.
- Record
UBUNTU-CVE-2020-13959- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVROOT-APP-MAVEN-CVE-2020-13959 No score
CVE-2020-13959 in io.root.org.apache.velocity:velocity-tools - Patched by Root
Root has patched CVE-2020-13959 in the io.root.org.apache.velocity:velocity-tools package for Root:Maven. Multiple fixed versions available.
- Record
ROOT-APP-MAVEN-CVE-2020-13959- Updated
- 2026-11-02
OSVUSN-6282-1 No score
velocity-tools vulnerability
Jackson Henry discovered that Velocity Tools incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to execute arbitrary code.
- Record
USN-6282-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.velocity.tools:velocity-tools-parentMaven |
before 3.1 | 3.1 |
org.apache.velocity:velocity-toolsMaven |
through 2.0 | None known |
velocity-toolsDebian:12 |
before 2.0-8 | 2.0-8 |
velocity-toolsDebian:13 |
before 2.0-8 | 2.0-8 |
velocity-toolsDebian:14 |
before 2.0-8 | 2.0-8 |
velocity-toolsDebian:9 |
before 2.0-6+deb9u1, plus listed versions 2.0-6 |
2.0-6+deb9u1 |
org.apache.velocity.tools:velocity-tools-parentMaven |
before 3.1, plus listed versions 3.0 |
3.1 |
org.apache.velocity:velocity-toolsMaven |
through 2.0, plus listed versions 1.32.0-beta22.0-beta32.0-beta4 |
None known |
velocity-toolsopenEuler:20.03-LTS-SP1 |
before 2.0-2.oe1 | 2.0-2.oe1 |
io.root.org.apache.velocity:velocity-toolsRoot:Maven |
before 2.0-root.io.1 | 2.0-root.io.1 |
velocity-toolsUbuntu:Pro:16.04:LTS |
before 2.0-4ubuntu0.1~esm1, plus listed versions 2.0-32.0-4 |
2.0-4ubuntu0.1~esm1 |
velocity-toolsUbuntu:Pro:18.04:LTS |
before 2.0-7ubuntu0.18.04.1~esm1, plus listed versions 2.0-62.0-7 |
2.0-7ubuntu0.18.04.1~esm1 |
velocity-toolsUbuntu:20.04:LTS |
before 2.0-7ubuntu0.20.04.1, plus listed versions 2.0-7 |
2.0-7ubuntu0.20.04.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-13959 is a medium vulnerability (CVSS 6.1) in Apache Velocity Tools, published March 10, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.70%, the 93rd percentile. Fixed in org.apache.velocity.tools:velocity-tools-parent 3.1.
References
lists.apache.org/thread.html/r6802a38c3041059e763a1aadd7b37fe95de75408144b5805e29b84e3%40%3Cuser.velocity.apache.org%3E
openwall.com/lists/oss-security/2021/03/10/2
lists.debian.org/debian-lts-announce/2021/03/msg00021.html
Show 12 moreShow less
security.gentoo.org/glsa/202107-52
nvd.nist.gov/vuln/detail/CVE-2020-13959
github.com/advisories/GHSA-fh63-4r66-jc7v
security-tracker.debian.org/tracker/CVE-2020-13959
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1122
ubuntu.com/security/CVE-2020-13959
cve.org/CVERecord?id=CVE-2020-13959