StackRadarChart IndexLive demo

CVE-2020-13959

Medium

Advisory

Published 12 Mar 2021In the index since 6 Sept 2026

Severity: Medium; worst across findings
CVSS: 6.1; base score, highest
EPSS: 0.057; 93rd percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 7; of 17,781 indexed, latest versions
Container images: 8; deployed by those charts
Fix available: None; affected package

Cross-site scripting (XSS) in Apache Velocity Tools

Carried by container images the latest versions of 7 of 17,781 indexed charts deploy, on 8 images.

Affected package	Affected versions	Fixed in	Images
velocity-toolsmaven	1.3, 1.4, 1.4-atlassian-2, 2.0	no fix listed	8

OSV records: GHSA-fh63-4r66-jc7v

Charts affected

7 by stars

Chart

Latest

Affected images

Radar Score

jiraatlassian-data-center

1 of 2 See more

jira atlassian-data-center 2.0.15

1 of the 2 container images this version deploys carry CVE-2020-13959.

Container image	Digest	Package	Fixed in
atlassian/jira-software :11.3.11	e5548cd4eea8	velocity-tools@1.4-atlassian-2	no fix listed

Open the chart page →

1,490

crowdatlassian-data-center

1 of 2 See more

crowd atlassian-data-center 2.0.15

1 of the 2 container images this version deploys carry CVE-2020-13959.

Container image	Digest	Package	Fixed in
atlassian/crowd :7.2.3	c81cc7d6bc9e	velocity-tools@1.4	no fix listed

Open the chart page →

1,415

jira-softwaremox

1 of 3 See more

jira-software mox 2.7.1

1 of the 3 container images this version deploys carry CVE-2020-13959.

Container image	Digest	Package	Fixed in
atlassian/jira-software :9.7.2	64a75aa4ec4e	velocity-tools@1.3	no fix listed

Open the chart page →

8,636

ibm-microclimateibm-charts

2 of 8 See more

ibm-microclimate ibm-charts 0.1.0

2 of the 8 container images this version deploys carry CVE-2020-13959.

Container image	Digest	Package	Fixed in
ibmcom/microclimate-file-watcher :latest	ab3fd1fdfa18	velocity-tools@2.0	no fix listed
ibmcom/microclimate-theia :latest	e17bdccc5030	velocity-tools@2.0	no fix listed

Open the chart page →

57,669

archivaslamdev

1 of 2 See more

archiva slamdev 0.0.7

1 of the 2 container images this version deploys carry CVE-2020-13959.

Container image	Digest	Package	Fixed in
xetusoss/archiva :v2.2.5	88f25242b9ee	velocity-tools@1.3	no fix listed

Open the chart page →

6,907

atlassian-confluencesomeblackmagic

1 of 1 See more

atlassian-confluence someblackmagic 3.4.1

1 of the 1 container images this version deploys carry CVE-2020-13959.

Container image	Digest	Package	Fixed in
atlassian/confluence-server :7.10.0	3b9222ab32ef	velocity-tools@1.4	no fix listed

Open the chart page →

13,605

atlassian-jirasomeblackmagic

1 of 1 See more

atlassian-jira someblackmagic 3.3.2

1 of the 1 container images this version deploys carry CVE-2020-13959.

Container image	Digest	Package	Fixed in
atlassian/jira-software :8.14.0	37bc46cbec1a	velocity-tools@1.3	no fix listed

Open the chart page →

13,079

Container images carrying it

8 by charts deploying them

A fixed version is listed for 0 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
atlassian/confluence-server :7.10.0	3b9222ab32ef	velocity-tools@1.4	no fix listed	1
atlassian/crowd :7.2.3	c81cc7d6bc9e	velocity-tools@1.4	no fix listed	1
atlassian/jira-software :8.14.0	37bc46cbec1a	velocity-tools@1.3	no fix listed	1
atlassian/jira-software :9.7.2	64a75aa4ec4e	velocity-tools@1.3	no fix listed	1
atlassian/jira-software :11.3.11	e5548cd4eea8	velocity-tools@1.4-atlassian-2	no fix listed	1
ibmcom/microclimate-file-watcher :latest	ab3fd1fdfa18	velocity-tools@2.0	no fix listed	1
ibmcom/microclimate-theia :latest	e17bdccc5030	velocity-tools@2.0	no fix listed	1
xetusoss/archiva :v2.2.5	88f25242b9ee	velocity-tools@1.3	no fix listed	1