What’s Vulnerable › Vulnerabilities

CVE-2020-13947

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 79.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-02-08 · updated 2026-06-17
• Weakness: CWE-79

Description

An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the message.jsp page of Apache ActiveMQ versions 5.15.12 through 5.16.0.

Affected products

• Apache ActiveMQ: before 5.15.14; from 5.16.0 before 5.16.1 — fixed in 5.15.14, 5.16.1
• Oracle Communications Session Report Manager: from 8.0.0 through 8.2.2
• Oracle Communications Session Route Manager: from 8.0.0 through 8.2.2

How to fix

Upgrade to a fixed version: Apache ActiveMQ 5.15.14, 5.16.1. Check the vendor advisory for mitigations.

References

• http://activemq.apache.org/security-advisories.data/CVE-2020-13947-announcement.txt
• https://lists.apache.org/thread.html/r021c490028f61c8b6f7e38efb98e61693b0cbb6b99b02238c6fc7d66%40%3Ccommits.activemq.apache.org%3E
• https://lists.apache.org/thread.html/ra66791f1f2b59fa651a81cec5202acdfbf34c2154fc0ff200301cc1c%40%3Cdev.activemq.apache.org%3E
• https://lists.apache.org/thread.html/ra66791f1f2b59fa651a81cec5202acdfbf34c2154fc0ff200301cc1c%40%3Cusers.activemq.apache.org%3E
• https://www.oracle.com/security-alerts/cpuApr2021.html
• https://www.oracle.com/security-alerts/cpuoct2021.html
• http://activemq.apache.org/security-advisories.data/CVE-2020-13947-announcement.txt
• https://lists.apache.org/thread.html/r021c490028f61c8b6f7e38efb98e61693b0cbb6b99b02238c6fc7d66%40%3Ccommits.activemq.apache.org%3E
• https://lists.apache.org/thread.html/ra66791f1f2b59fa651a81cec5202acdfbf34c2154fc0ff200301cc1c%40%3Cdev.activemq.apache.org%3E
• https://lists.apache.org/thread.html/ra66791f1f2b59fa651a81cec5202acdfbf34c2154fc0ff200301cc1c%40%3Cusers.activemq.apache.org%3E
• https://www.oracle.com/security-alerts/cpuApr2021.html
• https://www.oracle.com/security-alerts/cpuoct2021.html

Get alerted when CVE-2020-13947 or the next vulnerability affects your stack