PT-2016-4410 · Apache · Apache Activemq

Vladimir Ivanov · Publicado 2016-08-05 · Atualizado 2022-05-14 · CVE-2016-0782

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache ActiveMQ versions 5.0.0 through 5.11.3 Apache ActiveMQ versions 5.12.0 through 5.12.2 Apache ActiveMQ versions 5.13.0 through 5.13.1

Description The administration web console in Apache ActiveMQ allows remote authenticated users to conduct cross-site scripting (XSS) attacks. This can lead to obtaining sensitive information from a Java memory dump via vectors related to creating a queue.

Recommendations For Apache ActiveMQ versions 5.0.0 through 5.11.3, update to version 5.11.4 or later. For Apache ActiveMQ versions 5.12.0 through 5.12.2, update to version 5.12.3 or later. For Apache ActiveMQ versions 5.13.0 through 5.13.1, update to version 5.13.2 or later.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2016-0782

GHSA-8RCQ-P4GH-VMJ8

Produtos afetados

Apache Activemq

Referências · 17

• https://github.com/apache/activemq/compare/activemq-5.13.1...activemq-5.13.2 · Nota
• https://github.com/apache/activemq/commit/2061186a0a2486aebf26c4ceb8126933ed01826e · Nota
• https://github.com/apache/activemq/commit/0c9fdb5b4180c1ae800bbc8bae7a2c0620f6749b · Nota
• https://github.com/apache/activemq/commit/7828069637acb2f1ca1710523f6a2b216c12c7f8 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-0782 · Nota de Segurança
• http://activemq.apache.org/security-advisories.data/CVE-2016-0782-announcement.txt · Aviso do Fabricante
• http://securitytracker.com/id/1035328 · Nota
• https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2@%3Ccommits.activemq.apache.org%3E · Nota
• https://security-tracker.debian.org/tracker/CVE-2016-0782 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=1317516 · Nota
• https://osv.dev/vulnerability/CVE-2016-0782 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2016:1424 · Aviso do Fabricante
• https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apache.org%3E · Nota
• http://packetstormsecurity.com/files/136215/Apache-ActiveMQ-5.13.0-Cross-Site-Scripting.html · Nota
• http://securityfocus.com/archive/1/537760/100/0/threaded · Nota