Improper Neutralization of Input During Web Page Generation in Apache ActiveMQ
The administration web console in Apache ActiveMQ 5.x before 5.11.4, 5.12.x before 5.12.3, and 5.13.x before 5.13.2 allows remote authenticated users to conduct cross-site scripting (XSS) attacks and consequently obtain sensitive information from a Java memory dump via vectors related to creating a queue.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2016-0782US | medium5.4 | — | ||
The administration web console in Apache ActiveMQ 5.x before 5.11.4, 5.12.x before 5.12.3, and 5.13.x before 5.13.2 allows remote authenticated users to conduct cross-site scriptin… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- http://activemq.apache.org/security-advisories.data/CVE-2016-0782-announcement.txtWEB
- http://packetstormsecurity.com/files/136215/Apache-ActiveMQ-5.13.0-Cross-Site-Scripting.htmlWEB
- https://access.redhat.com/errata/RHSA-2016:1424WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=1317516WEB
- https://github.com/apache/activemq/commit/0c9fdb5b4180c1ae800bbc8bae7a2c0620f6749bWEB
- https://github.com/apache/activemq/commit/2061186a0a2486aebf26c4ceb8126933ed01826eWEB
- https://github.com/apache/activemq/commit/7828069637acb2f1ca1710523f6a2b216c12c7f8WEB
- https://github.com/apache/activemq/compare/activemq-5.13.1...activemq-5.13.2WEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan