CVE-2020-1941: XSS

Q: What is CVE-2020-1941?

CVE-2020-1941 is a vulnerability in Apache ActiveMQ that allows remote attackers to execute script in a victim's web browser.

Q: How does CVE-2020-1941 work?

CVE-2020-1941 works by exploiting a cross-site scripting vulnerability in the admin GUI of Apache ActiveMQ.

Q: What is the severity of CVE-2020-1941?

CVE-2020-1941 has a severity rating of medium with a CVSS score of 6.1.

Q: Which software versions are affected by CVE-2020-1941?

CVE-2020-1941 affects Apache ActiveMQ versions 5.0.0 to 5.15.11.

Q: How can CVE-2020-1941 be fixed?

To fix CVE-2020-1941, users should update to a patched version of Apache ActiveMQ.

Published May 14, 2020

Updated

Apache ActiveMQ is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the admin GUI. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.

Other sources

In Apache ActiveMQ 5.0.0 to 5.15.11, the webconsole admin GUI is open to XSS, in the view that lists the contents of a queue.

Affected Software

21 affected componentsFixes available

maven/org.apache.activemq:activemq-web-console>=5.0.0<5.15.12

5.15.12

IBM Data Virtualization on Cloud Pak for Data<=3.0

IBM Watson Query on Cloud Pak for Data<=2.2

IBM Watson Query on Cloud Pak for Data<=2.1

IBM Watson Query on Cloud Pak for Data<=2.0

IBM Data Virtualization on Cloud Pak for Data<=1.8

IBM Data Virtualization on Cloud Pak for Data<=1.7

apache ActiveMQ>=5.0.0<=5.15.11

ORACLE Communications Diameter Signaling Router>=8.0.0<=8.2.2

ORACLE Communications Element Manager=8.1.1

ORACLE Communications Element Manager=8.2.0

ORACLE Communications Element Manager=8.2.1

ORACLE Communications Session Report Manager=8.1.1

ORACLE Communications Session Report Manager=8.2.0

ORACLE Communications Session Report Manager=8.2.1

ORACLE Communications Session Route Manager=8.1.1

ORACLE Communications Session Route Manager=8.2.0

ORACLE Communications Session Route Manager=8.2.1

ORACLE Enterprise Repository=11.1.1.7.0

ORACLE FLEXCUBE Private Banking=12.0.0

ORACLE FLEXCUBE Private Banking=12.1.0

Remediation

Patch Available

https://lists.apache.org/thread.html/r946488fb942fd35c6a6e0359f52504a558ed438574a8f14d36d7dcd7@%3Ccommits.activemq.apache.org%3E

Event History

May 14, 2020

CVE Published

via MITRE·04:29 PM

Data Sourced

via MITRE·04:29 PM

DescriptionWeakness

May 21, 2020

Advisory Published

via GitHub·09:08 PM

Aug 15, 2025

Data Sourced

via IBM·03:29 PM

DescriptionAffected Software

Parent advisories

This vulnerability appears in the following advisories.

IBM-7183851

Frequently Asked Questions

What is CVE-2020-1941?

CVE-2020-1941 is a vulnerability in Apache ActiveMQ that allows remote attackers to execute script in a victim's web browser.

How does CVE-2020-1941 work?