CVE-2020-13932 Cross-site Scripting (XSS) in Apache ActiveMQ Artemis

What is CVE-2020-13932?

CVE-2020-13932 is a medium-severity cross-site scripting vulnerability in Apache ActiveMQ Artemis, published on 20 Jul 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

In Apache ActiveMQ Artemis 2.5.0 to 2.13.0, a specially crafted MQTT packet which has an XSS payload as client-id or topic name can exploit this vulnerability. The XSS payload is being injected into the admin console's browser. The XSS payload is triggered in the diagram plugin; queue node and the info section.

Weakness: CWE-79

Which versions are affected by CVE-2020-13932?

2 open source packages ship an affected version, including org.apache.activemq:apache-artemis. It affects 1 product.

Products include Apache Artemis.

How do I fix CVE-2020-13932?

Upgrade org.apache.activemq:apache-artemis to 2.14.0 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2020-13932 being exploited?

There is no known exploitation of CVE-2020-13932 in the wild and no public exploit code.

Other vulnerabilities in Apache ActiveMQ Artemis

• CVE-2026-57967 Apache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachment Critical 9.8
• CVE-2026-27446 Apache Artemis, Apache ActiveMQ Artemis: Auth bypass for Core downstream federation Critical 9.3
• CVE-2026-49364 Information disclosure in Apache ActiveMQ Artemis Critical 9.1
• CVE-2026-67593 Missing authorization in Apache ActiveMQ Artemis Critical 9.1
• CVE-2023-50780 Apache ActiveMQ Artemis: Authenticated users could perform RCE via Jolokia MBeans High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-3h2h-xqr2-2jp7.