Undisclosed Apache Velocity XSS vulnerability impacts GOV sites

guest · Jan 15, 2021

Undisclosed Apache Velocity XSS vulnerability impacts GOV sites
January 15, 2021
https://www.bleepingcomputer.com/ne...velocity-xss-vulnerability-impacts-gov-sites/

An undisclosed Cross-Site Scripting (XSS) vulnerability in Apache Velocity Tools can be exploited by unauthenticated attackers to target government sites, including NASA.

Although 90 days have elapsed since the vulnerability was reported and patched, BleepingComputer is not aware of a formal disclosure made by the project.
Click to expand...

Govt sites using Apache Velocity Tools vulnerable to XSS
Although a formal vulnerability disclosure has not taken place, BleepingComputer has been informed that this flaw is being internally tracked as CVE-2020-13959.

On querying Sonatype's Nexus Intelligence systems, I discovered the Apache Velocity Tools class containing this flaw is included in over 2,600 unique binaries of prominent software applications available to download from npm, PyPI, Maven Central, and other open-source repositories.

Although the project had acknowledged Henry's report and issued a publicly visible fix on GitHub on November 5th, 2020, a proper public disclosure never took place which left Sakura Samurai researchers concerned.
Click to expand...

Log in or Sign up

Undisclosed Apache Velocity XSS vulnerability impacts GOV sites

guest Guest

Log in or Sign up

Undisclosed Apache Velocity XSS vulnerability impacts GOV sites

guest Guest

Useful Searches