Re: CVE-2020-13959: Velocity Tools XSS Vulnerability

Hi all,

I try to find out if this CVE-2020-13959 also affect the older Velocity 1.7=
 version.=20

>     <groupId>org.apache.velocity</groupId>
>     <artifactId>velocity</artifactId>
>     <version>1.7</version>

As we are using dependencies which require this old Velocity version.
Unfortunately the CVE description on NVD is not clear about this.
Furthermore I tried to check it by myself based on the GitHub repo, but was=
 not successful.

It would be very kind if someone could help me.

Kind Regards, Michael=20

On 2021/03/10 06:50:56, Will Glass-Husain <[email protected]> wrote:=20
> Description:>=20
>=20
> The default error page for VelocityView reflects back the vm file that>=20
> was entered as part of the URL.  An attacker can set an XSS payload>=20
> file as this vm file in the URL which results in this payload being>=20
> executed.>=20
>=20
> XSS vulnerabilities allow attackers to execute arbitrary JavaScript in>=20
> the context of the attacked website and the attacked user. This can be>=20
> abused to steal session cookies, perform requests in the name of the>=20
> victim or for phishing attacks.>=20
>=20
> Mitigation:>=20
>=20
> Applications based on Apache Velocity Tools should upgrade to version>=20
> 3.1.  This version escapes the reflected text on the default error>=20
> page, preventing potential javascript execution.>=20
>=20
> Credit:>=20
>=20
> This issue was reported and a patch was submitted by Jackson Henry,>=20
> member of Sakura Samurai.>=20
>=20
> --------------------------------------------------------------------->=20
> To unsubscribe, e-mail: [email protected]>=20
> For additional commands, e-mail: [email protected]>=20
>=20
> =