Medium DLA-2597-1 1 CVE

velocity-tools - security update

Published Mar 17, 2021 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

Release	Package	Fixed in
Debian · 9	velocity-tools	2.0-6+deb9u1

Vulnerabilities 1

Medium 6.1

CVE-2020-13959

Velocity Tools XSS Vulnerability

The default error page for VelocityView in Apache Velocity Tools prior to 3.1 reflects back the vm file that was entered as part of the URL. An attacker can set an XSS payload file as this vm file in the URL which results in this payload being executed. XSS v…

Apache Software Foundation Apache Velocity Tools org.apache.velocity:velocity-tools velocity-tools Debian Ubuntu Maven

Mar 10, 2021