CVE-2020-13959 (Medium) detected in velocity-tools-2.0.jar

[mend-for-github-com]

CVE-2020-13959 - Medium Severity Vulnerability

Vulnerable Library - velocity-tools-2.0.jar

VelocityTools is an integrated collection of Velocity subprojects with the common goal of creating tools and infrastructure to speed and ease development of both web and non-web applications using the Velocity template engine.

Path to dependency file: /plugins/portlet/pom.xml

Path to vulnerable library: /epository/org/apache/velocity/velocity-tools/2.0/velocity-tools-2.0.jar,/epository/org/apache/velocity/velocity-tools/2.0/velocity-tools-2.0.jar,/epository/org/apache/velocity/velocity-tools/2.0/velocity-tools-2.0.jar,/epository/org/apache/velocity/velocity-tools/2.0/velocity-tools-2.0.jar,/epository/org/apache/velocity/velocity-tools/2.0/velocity-tools-2.0.jar,/epository/org/apache/velocity/velocity-tools/2.0/velocity-tools-2.0.jar

Dependency Hierarchy:

• ❌ velocity-tools-2.0.jar (Vulnerable Library)

Found in base branch: master

Vulnerability Details

The default error page for VelocityView in Apache Velocity Tools prior to 3.1 reflects back the vm file that was entered as part of the URL. An attacker can set an XSS payload file as this vm file in the URL which results in this payload being executed. XSS vulnerabilities allow attackers to execute arbitrary JavaScript in the context of the attacked website and the attacked user. This can be abused to steal session cookies, perform requests in the name of the victim or for phishing attacks.

Publish Date: 2021-03-10

URL: CVE-2020-13959

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-fh63-4r66-jc7v

Release Date: 2021-03-10

Fix Resolution: org.apache.velocity.tools:velocity-tools-view:3.1

---

• Check this box to open an automated fix PR