Improper Neutralization of Input During Web Page Generation in Apache ActiveMQ
The administration web console in Apache ActiveMQ 5.x before 5.11.4, 5.12.x before 5.12.3, and 5.13.x before 5.13.2 allows remote authenticated users to conduct cross-site scripting (XSS) attacks and consequently obtain sensitive information from a Java memory dump via vectors related to creating a queue.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2016-0782US | medium5.4 | — | ||
The administration web console in Apache ActiveMQ 5.x before 5.11.4, 5.12.x before 5.12.3, and 5.13.x before 5.13.2 allows remote authenticated users to conduct cross-site scriptin… | ||||
02
references
External citations — patches, advisories, analysis.
- http://activemq.apache.org/security-advisories.data/CVE-2016-0782-announcement.txtWEB
- http://packetstormsecurity.com/files/136215/Apache-ActiveMQ-5.13.0-Cross-Site-Scripting.htmlWEB
- https://access.redhat.com/errata/RHSA-2016:1424WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=1317516WEB
- https://github.com/apache/activemq/commit/0c9fdb5b4180c1ae800bbc8bae7a2c0620f6749bWEB
- https://github.com/apache/activemq/commit/2061186a0a2486aebf26c4ceb8126933ed01826eWEB
- https://github.com/apache/activemq/commit/7828069637acb2f1ca1710523f6a2b216c12c7f8WEB
- https://github.com/apache/activemq/compare/activemq-5.13.1...activemq-5.13.2WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan