Detections
Analytics
SCA: security update for org.apache.velocity.tools:velocity-tools-parent (GHSA-fh63-4r66-jc7v)
medium Tenable Cloud Security Plugin ID 414522
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- The default error page for VelocityView in Apache Velocity Tools prior to 3.1 reflects back the vm file
that was entered as part of the URL. An attacker can set an XSS payload file as this vm file in the URL
which results in this payload being executed. XSS vulnerabilities allow attackers to execute arbitrary
JavaScript in the context of the attacked website and the attacked user. This can be abused to steal
session cookies, perform requests in the name of the victim or for phishing attacks. (CVE-2020-13959)
See Also
Plugin Details
Severity: Medium
ID: 414522
Version: Revision 1.5
Type: Local
Family: SCA Checks
Published: 1/23/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 2.3
Percentile: 8.67
Vendor
Vendor Severity: Medium
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 3.2
Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N
CVSS Score Source: CVE-2020-13959
CVSS v3
Risk Factor: Medium
Base Score: 6.1
Temporal Score: 5.3
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 3/12/2021
Vulnerability Publication Date: 3/10/2021
Reference Information
CVE: CVE-2020-13959
cwe: CWE-79