CVE-2020-1941
Apache ActiveMQ webconsole admin GUI is open to XSS
CVE-2020-1941 is a medium vulnerability (CVSS 6.1) in Apache Activemq, published May 14, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 7.15%, the 94th percentile. Fixed in org.apache.activemq:activemq-web-console 5.15.12.
In Apache ActiveMQ 5.0.0 to 5.15.11, the webconsole admin GUI is open to XSS, in the view that lists the contents of a queue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
In Apache ActiveMQ 5.0.0 to 5.15.11, the webconsole admin GUI is open to XSS, in the view that lists the contents of a queue.
- Record
CVE-2020-1941- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
In Apache ActiveMQ 5.0.0 to 5.15.11, the webconsole admin GUI is open to XSS, in the view that lists the contents of a queue.
- Record
CVE-2020-1941- Updated
- 2026-11-02
EUVDEUVD-2020-0419 No score
In Apache ActiveMQ 5.0.0 to 5.15.11, the webconsole admin GUI is open to XSS, in the view that lists the contents of a queue.
- Record
EUVD-2020-0419- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-cc94-3v9c-7rm8
Apache ActiveMQ webconsole admin GUI is open to XSS
In Apache ActiveMQ 5.0.0 to 5.15.11, the webconsole admin GUI is open to XSS, in the view that lists the contents of a queue.
- Record
GHSA-cc94-3v9c-7rm8- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
In Apache ActiveMQ 5.0.0 to 5.15.11, the webconsole admin GUI is open to XSS, in the view that lists the contents of a queue.
- Record
CVE-2020-1941- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-1941
In Apache ActiveMQ 5.0.0 to 5.15.11, the webconsole admin GUI is open to XSS, in the view that lists the contents of a queue.
- Record
DEBIAN-CVE-2020-1941- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-cc94-3v9c-7rm8
Apache ActiveMQ webconsole admin GUI is open to XSS
In Apache ActiveMQ 5.0.0 to 5.15.11, the webconsole admin GUI is open to XSS, in the view that lists the contents of a queue.
- Record
GHSA-cc94-3v9c-7rm8- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-1941
In Apache ActiveMQ 5.0.0 to 5.15.11, the webconsole admin GUI is open to XSS, in the view that lists the contents of a queue.
- Record
UBUNTU-CVE-2020-1941- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVBIT-activemq-2020-1941 No score
In Apache ActiveMQ 5.0.0 to 5.15.11, the webconsole admin GUI is open to XSS, in the view that lists the contents of a queue.
- Record
BIT-activemq-2020-1941- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.activemq:activemq-web-consoleMaven |
5.0.0 up to 5.15.12 | 5.15.12 |
activemqBitnami |
5.0.0 to 5.15.11 | None known |
activemqDebian:12 |
before 5.16.0-1 | 5.16.0-1 |
activemqDebian:13 |
before 5.16.0-1 | 5.16.0-1 |
org.apache.activemq:activemq-web-consoleMaven |
5.0.0 up to 5.15.12, plus listed versions 5.1.05.10.05.10.15.10.25.11.0 Show 45 moreShow less5.11.15.11.25.11.35.11.45.12.05.12.15.12.25.12.35.13.05.13.15.13.25.13.35.13.45.13.55.14.05.14.15.14.25.14.35.14.45.14.55.15.05.15.15.15.105.15.115.15.25.15.35.15.45.15.55.15.65.15.75.15.85.15.95.2.05.3.05.3.15.3.25.4.05.4.15.4.25.4.35.5.05.5.15.6.05.7.05.8.0 |
5.15.12 |
activemqUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 5.6.0+dfsg1-4+deb8u1ubuntu15.6.0+dfsg1-55.13.2+dfsg-25.13.2+dfsg-2ubuntu0.1~esm1 |
None known |
activemqUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 5.14.5-35.15.2-25.15.3-25.15.8-2~18.045.15.8-2~18.04.1~esm1 |
None known |
activemqUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 5.15.10-15.15.11-15.15.11-1ubuntu0.1~esm1 |
None known |
activemqUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 5.16.1-15.16.1-1ubuntu0.1~esm15.16.1-1ubuntu0.1 |
None known |
activemqUbuntu:24.04:LTS |
All versions, plus listed versions 5.17.2+dfsg-25.17.6+dfsg-1 |
None known |
activemqUbuntu:25.10 |
All versions, plus listed versions 5.17.6+dfsg-15.17.6+dfsg-2 |
None known |
activemqUbuntu:26.10 |
All versions, plus listed versions 5.17.6+dfsg-25.17.6+dfsg-2ubuntu1 |
None known |
activemqUbuntu:26.04:LTS |
All versions, plus listed versions 5.17.6+dfsg-2 |
None known |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases, products | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
oracle.com/security-alerts/cpujul2020.html
activemq.apache.org/security-advisories.data/CVE-2020-1941-announcement.txt
lists.apache.org/thread.html/re4672802b0e5ed67c08c9e77057d52138e062f77cc09581b723cf95a%40%3Ccommits.activemq.apache.org%3E
Show 16 moreShow less
nvd.nist.gov/vuln/detail/CVE-2020-1941
github.com/apache/activemq/commit/7793a95
issues.apache.org/jira/browse/AMQ-7231
security-tracker.debian.org/tracker/CVE-2020-1941
ubuntu.com/security/CVE-2020-1941
cve.org/CVERecord?id=CVE-2020-1941
Left out here: 2 versions. The JSON record has them.