The default error page for VelocityView in Apache Velocity Tools prior to 3.1 reflects back the vm file that was entered as part of the URL. An attacker can set an XSS payload file as this vm file in the URL which results in this payload being executed. XSS vulnerabilities allow attackers to execute arbitrary JavaScript in the context of the attacked website and the attacked user. This can be abused to steal session cookies, perform requests in the name of the victim or for phishing attacks.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-016718 advisory.

    The default error page for VelocityView in Apache Velocity Tools prior to 3.1 reflects back the vm file     that was entered as part of the URL. An attacker can set an XSS payload file as this vm file in the URL     which results in this payload being executed. XSS vulnerabilities allow attackers to execute arbitrary     JavaScript in the context of the attacked website and the attacked user. This can be abused to steal     session cookies, perform requests in the name of the victim or for phishing attacks.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The default error page for VelocityView in Apache Velocity Tools prior to 3.1 reflects back the vm file
    that was entered as part of the URL. An attacker can set an XSS payload file as this vm file in the URL
    which results in this payload being executed. XSS vulnerabilities allow attackers to execute arbitrary
    JavaScript in the context of the attacked website and the attacked user. This can be abused to steal
    session cookies, perform requests in the name of the victim or for phishing attacks. (CVE-2020-13959)

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-6282-1 advisory.

    Jackson Henry discovered that Velocity Tools incorrectly handled certain inputs. If a user or an automated     system were tricked into opening a specially crafted input file, a remote attacker could possibly use this     issue to execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202107-52 (Apache Velocity: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Apache Velocity. Please       review the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

It was discovered that there was a cross-site scripting (XSS) vulnerability in velocity-tools, a collection of useful tools for the 'Velocity' template engine.

The default error page could be exploited to steal session cookies, perform requests in the name of the victim, used for phishing attacks and many other similar attacks.

For Debian 9 'Stretch', this problem has been fixed in version 2.0-6+deb9u1.

We recommend that you upgrade your velocity-tools packages.

For the detailed security status of velocity-tools please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/velocity-tools

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
316307	Unity Linux 20.1070e Security Update: velocity-tools (UTSA-2026-016718)	Nessus	Unity Linux Local Security Checks	medium
414522	SCA: security update for org.apache.velocity.tools:velocity-tools-parent (GHSA-fh63-4r66-jc7v)	Tenable Cloud Security	SCA Checks	medium
414522	SCA: security update for org.apache.velocity.tools:velocity-tools-parent (GHSA-fh63-4r66-jc7v)	Tenable Self-Hosted Container Security	SCA Checks	medium
179660	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS : Velocity Tools vulnerability (USN-6282-1)	Nessus	Ubuntu Local Security Checks	medium
154715	GLSA-202107-52 : Apache Velocity: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
147898	Debian DLA-2597-1 : velocity-tools security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2020-13959

medium

Tenable Plugins

medium

medium

medium

medium

high

medium