GitHub Advisoryadvisory · Maven

GHSA-hvwm-2624-rp9x Apache ActiveMQ web console vulnerable to Cross-site Scripting

MEDIUM Published 2018-10-30 Modified 2024-03-14 Official page ↗
Aliases
CVE-2018-8006
Ecosystem
Maven
Packages
org.apache.activemq:activemq-web-console
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2020-06-16

Affected packages

• Maven org.apache.activemq:activemq-web-console: >= 5.0.0, < 5.15.6 → fixed in 5.15.6

Description

An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the queue.jsp page of Apache ActiveMQ versions 5.0.0 to 5.15.5. The root cause of this issue is improper data filtering of the QueueFilter parameter.

Related

Alias · CVE (1)

  • CVE-2018-8006 An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the queue.jsp… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References