Django REST framework

Vulnerability Instance

Lookup for vulnerabilities affecting packages.

Vulnerability_idVCID-h1wx-mfju-eker
Summary
Cross-site scripting (XSS) in Apache Velocity Tools
The default error page for VelocityView in Apache Velocity Tools prior to 3.1 reflects back the vm file that was entered as part of the URL. An attacker can set an XSS payload file as this vm file in the URL which results in this payload being executed. XSS vulnerabilities allow attackers to execute arbitrary JavaScript in the context of the attacked website and the attacked user. This can be abused to steal session cookies, perform requests in the name of the victim or for phishing attacks.
Aliases
0
alias CVE-2020-13959
1
alias GHSA-fh63-4r66-jc7v
Fixed_packages
0
url pkg:deb/debian/velocity-tools@2.0-8?distro=trixie
purl pkg:deb/debian/velocity-tools@2.0-8?distro=trixie
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/velocity-tools@2.0-8%3Fdistro=trixie
1
url pkg:deb/debian/velocity-tools@2.0-8
purl pkg:deb/debian/velocity-tools@2.0-8
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/velocity-tools@2.0-8
2
url pkg:deb/debian/velocity-tools@2.0-9?distro=trixie
purl pkg:deb/debian/velocity-tools@2.0-9?distro=trixie
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/velocity-tools@2.0-9%3Fdistro=trixie
3
url pkg:ebuild/dev-java/velocity@2.3
purl pkg:ebuild/dev-java/velocity@2.3
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:ebuild/dev-java/velocity@2.3
4
url pkg:maven/org.apache.velocity.tools/velocity-tools-parent@3.1
purl pkg:maven/org.apache.velocity.tools/velocity-tools-parent@3.1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.velocity.tools/velocity-tools-parent@3.1
Affected_packages
0
url pkg:deb/debian/velocity-tools@1.4-4
purl pkg:deb/debian/velocity-tools@1.4-4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-h1wx-mfju-eker
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/velocity-tools@1.4-4
1
url pkg:deb/debian/velocity-tools@2.0-2
purl pkg:deb/debian/velocity-tools@2.0-2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-h1wx-mfju-eker
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/velocity-tools@2.0-2
2
url pkg:deb/debian/velocity-tools@2.0-3
purl pkg:deb/debian/velocity-tools@2.0-3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-h1wx-mfju-eker
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/velocity-tools@2.0-3
3
url pkg:deb/debian/velocity-tools@2.0-6
purl pkg:deb/debian/velocity-tools@2.0-6
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-h1wx-mfju-eker
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/velocity-tools@2.0-6
4
url pkg:deb/debian/velocity-tools@2.0-7
purl pkg:deb/debian/velocity-tools@2.0-7
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-h1wx-mfju-eker
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/velocity-tools@2.0-7
5
url pkg:maven/org.apache.velocity/velocity-tools@1.3
purl pkg:maven/org.apache.velocity/velocity-tools@1.3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-h1wx-mfju-eker
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.velocity/velocity-tools@1.3
6
url pkg:maven/org.apache.velocity/velocity-tools@2.0-beta2
purl pkg:maven/org.apache.velocity/velocity-tools@2.0-beta2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-h1wx-mfju-eker
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.velocity/velocity-tools@2.0-beta2
7
url pkg:maven/org.apache.velocity/velocity-tools@2.0-beta3
purl pkg:maven/org.apache.velocity/velocity-tools@2.0-beta3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-h1wx-mfju-eker
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.velocity/velocity-tools@2.0-beta3
8
url pkg:maven/org.apache.velocity/velocity-tools@2.0-beta4
purl pkg:maven/org.apache.velocity/velocity-tools@2.0-beta4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-h1wx-mfju-eker
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.velocity/velocity-tools@2.0-beta4
9
url pkg:maven/org.apache.velocity/velocity-tools@2.0
purl pkg:maven/org.apache.velocity/velocity-tools@2.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-h1wx-mfju-eker
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.velocity/velocity-tools@2.0
10
url pkg:maven/org.apache.velocity.tools/velocity-tools@2.0-alpha1
purl pkg:maven/org.apache.velocity.tools/velocity-tools@2.0-alpha1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-h1wx-mfju-eker
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.velocity.tools/velocity-tools@2.0-alpha1
11
url pkg:maven/org.apache.velocity.tools/velocity-tools-parent@3.0
purl pkg:maven/org.apache.velocity.tools/velocity-tools-parent@3.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-h1wx-mfju-eker
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.velocity.tools/velocity-tools-parent@3.0
References
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-13959.json
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-13959.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2020-13959
reference_id
reference_type
scores
0
value 0.03207
scoring_system epss
scoring_elements 0.87054
published_at 2026-04-24T12:55:00Z
1
value 0.03207
scoring_system epss
scoring_elements 0.87024
published_at 2026-04-12T12:55:00Z
2
value 0.03207
scoring_system epss
scoring_elements 0.87035
published_at 2026-04-21T12:55:00Z
3
value 0.03207
scoring_system epss
scoring_elements 0.87038
published_at 2026-04-18T12:55:00Z
4
value 0.03207
scoring_system epss
scoring_elements 0.87034
published_at 2026-04-16T12:55:00Z
5
value 0.03207
scoring_system epss
scoring_elements 0.87018
published_at 2026-04-13T12:55:00Z
6
value 0.03207
scoring_system epss
scoring_elements 0.86966
published_at 2026-04-01T12:55:00Z
7
value 0.03207
scoring_system epss
scoring_elements 0.86976
published_at 2026-04-02T12:55:00Z
8
value 0.03207
scoring_system epss
scoring_elements 0.86995
published_at 2026-04-04T12:55:00Z
9
value 0.03207
scoring_system epss
scoring_elements 0.86988
published_at 2026-04-07T12:55:00Z
10
value 0.03207
scoring_system epss
scoring_elements 0.87008
published_at 2026-04-08T12:55:00Z
11
value 0.03207
scoring_system epss
scoring_elements 0.87016
published_at 2026-04-09T12:55:00Z
12
value 0.03207
scoring_system epss
scoring_elements 0.87029
published_at 2026-04-11T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2020-13959
2
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13959
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13959
3
reference_url https://lists.apache.org/thread.html/r6802a38c3041059e763a1aadd7b37fe95de75408144b5805e29b84e3@%3Cuser.velocity.apache.org%3E
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://lists.apache.org/thread.html/r6802a38c3041059e763a1aadd7b37fe95de75408144b5805e29b84e3@%3Cuser.velocity.apache.org%3E
4
reference_url https://lists.apache.org/thread.html/r6802a38c3041059e763a1aadd7b37fe95de75408144b5805e29b84e3%40%3Cuser.velocity.apache.org%3E
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://lists.apache.org/thread.html/r6802a38c3041059e763a1aadd7b37fe95de75408144b5805e29b84e3%40%3Cuser.velocity.apache.org%3E
5
reference_url https://lists.apache.org/thread.html/r97edad0655770342d2d36620fb1de50b142fcd6c4f5c53dd72ca41d7@%3Cuser.velocity.apache.org%3E
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://lists.apache.org/thread.html/r97edad0655770342d2d36620fb1de50b142fcd6c4f5c53dd72ca41d7@%3Cuser.velocity.apache.org%3E
6
reference_url https://lists.apache.org/thread.html/rb042f3b0090e419cc9f5a3d32cf0baff283ccd6fcb1caea61915d6b6@%3Ccommits.velocity.apache.org%3E
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://lists.apache.org/thread.html/rb042f3b0090e419cc9f5a3d32cf0baff283ccd6fcb1caea61915d6b6@%3Ccommits.velocity.apache.org%3E
7
reference_url https://lists.apache.org/thread.html/rf9868c564cff7adfd5283563f2309b93b3e496354a211a57503b2f72@%3Cannounce.apache.org%3E
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://lists.apache.org/thread.html/rf9868c564cff7adfd5283563f2309b93b3e496354a211a57503b2f72@%3Cannounce.apache.org%3E
8
reference_url https://lists.debian.org/debian-lts-announce/2021/03/msg00021.html
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://lists.debian.org/debian-lts-announce/2021/03/msg00021.html
9
reference_url https://nvd.nist.gov/vuln/detail/CVE-2020-13959
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2020-13959
10
reference_url https://security.gentoo.org/glsa/202107-52
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://security.gentoo.org/glsa/202107-52
11
reference_url http://www.openwall.com/lists/oss-security/2021/03/10/2
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2021/03/10/2
12
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=1937445
reference_id 1937445
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=1937445
13
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=985221
reference_id 985221
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=985221
14
reference_url https://github.com/advisories/GHSA-fh63-4r66-jc7v
reference_id GHSA-fh63-4r66-jc7v
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-fh63-4r66-jc7v
15
reference_url https://usn.ubuntu.com/6282-1/
reference_id USN-6282-1
reference_type
scores
url https://usn.ubuntu.com/6282-1/
Weaknesses
0
cwe_id 79
name Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
description The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
1
cwe_id 1035
name OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.
2
cwe_id 937
name OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.
Exploits
Severity_range_score4.0 - 6.9
Exploitability0.5
Weighted_severity6.2
Risk_score3.1
Resource_urlhttp://public2.vulnerablecode.io/vulnerabilities/VCID-h1wx-mfju-eker