CVE-2020-13947

published 2021-02-08

CVE-2020-13947: An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the message.jsp page of Apache…

Priority P3 46 medium 6.1 CVSS 3.1

AV N AC L PR N UI R S C C L I L A N

An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the message.jsp page of Apache ActiveMQ versions 5.15.12 through 5.16.0.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
apache	activemq	< 5.15.14	5.15.14
apache	activemq	>= 0 < 5.16.1-1	5.16.1-1
apache	activemq	>= 0 < 5.16.1-1	5.16.1-1
apache	activemq	>= 0 < 5.16.1-1	5.16.1-1
apache	activemq	>= 5.16.0 < 5.16.1	5.16.1
debian	activemq	< activemq 5.16.1-1 (bookworm)	activemq 5.16.1-1 (bookworm)
oracle	communications_session_report_manager	8.0.0 – 8.2.2	—
oracle	communications_session_route_manager	8.0.0 – 8.2.2	—

Detection & IOCs extracted from sources · hover to see the quote

path /admin/message.jsp

snort

alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Apache ActiveMQ Web Console message jsp Cross-Site Scripting (CVE-2020-13947) M1"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/admin/message.jsp"; fast_pattern; http.request_body; content:"JMSDestination|3d|"; nocase; pcre:"/^.+(script|onmouse[a-z]+|onkey[a-z]+|onerror|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3d)/Ri"; reference:cve,2020-13947; classtype:web-application-attack; sid:2059303; rev:1; metadata:affected_product Apache_ActiveMQ, attack_target Web_Server, tls_state TLSDecrypt, created_at 2025_01_17, cve CVE_2020_13947, deployment Perimeter, deployment Internal, deployment Datacenter, deployment SSLDecrypt, performance_impact Low, confidence High, signature_severity Major, tag Exploit, updated_at 2025_01_17, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)

snort

alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Apache ActiveMQ Web Console message jsp Cross-Site Scripting (CVE-2020-13947) M2"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/admin/message.jsp"; fast_pattern; content:"JMSDestination="; nocase; distance:0; pcre:"/^.+(script|onmouse[a-z]+|onkey[a-z]+|onerror|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3d)/Ri"; reference:cve,2020-13947; classtype:web-application-attack; sid:2059304; rev:1; metadata:affected_product Apache_ActiveMQ, attack_target Web_Server, tls_state TLSDecrypt, created_at 2025_01_17, cve CVE_2020_13947, deployment Perimeter, deployment Internal, deployment Datacenter, deployment SSLDecrypt, performance_impact Low, confidence High, signature_severity Major, tag Exploit, updated_at 2025_01_17, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application;)

• → XSS payload is injected via the JMSDestination parameter in POST requests to /admin/message.jsp; look for URL-encoded '=' (|3d|) in the request body alongside script/event handler keywords.
• → XSS payload is also delivered via GET requests to /admin/message.jsp with JMSDestination= in the URI/query string containing script or HTML event handler keywords.
• → The vulnerability is present in the web-based administration console on the message.jsp page; restrict external access to the ActiveMQ admin console to reduce attack surface. ↗

• · Both Snort rules require TLS inspection (tls_state TLSDecrypt / deployment SSLDecrypt) to fire on HTTPS-protected ActiveMQ admin consoles; without TLS decryption, encrypted exploit traffic will not be detected.

CVSS provenance

nvd v3.1 6.1 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

nvd v2.0 4.3 MEDIUM AV:N/AC:M/Au:N/C:N/I:P/A:N

osv 6.1 MEDIUM

vendor_debian 6.1 LOW

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-79