PT-2016-4410 · Apache · Apache Activemq

Vladimir Ivanov · Published 2016-08-05 · Updated 2022-05-14 · CVE-2016-0782

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache ActiveMQ versions 5.0.0 through 5.11.3 Apache ActiveMQ versions 5.12.0 through 5.12.2 Apache ActiveMQ versions 5.13.0 through 5.13.1

Description The administration web console in Apache ActiveMQ allows remote authenticated users to conduct cross-site scripting (XSS) attacks. This can lead to obtaining sensitive information from a Java memory dump via vectors related to creating a queue.

Recommendations For Apache ActiveMQ versions 5.0.0 through 5.11.3, update to version 5.11.4 or later. For Apache ActiveMQ versions 5.12.0 through 5.12.2, update to version 5.12.3 or later. For Apache ActiveMQ versions 5.13.0 through 5.13.1, update to version 5.13.2 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2016-0782

GHSA-8RCQ-P4GH-VMJ8

Affected Products

Apache Activemq

References · 17

• https://nvd.nist.gov/vuln/detail/CVE-2016-0782 · Security Note
• http://activemq.apache.org/security-advisories.data/CVE-2016-0782-announcement.txt · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2016-0782 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-0782 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2016:1424 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-0782 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8rcq-p4gh-vmj8 · Vendor Advisory
• https://github.com/apache/activemq/compare/activemq-5.13.1...activemq-5.13.2 · Note
• https://github.com/apache/activemq/commit/2061186a0a2486aebf26c4ceb8126933ed01826e · Note
• https://github.com/apache/activemq/commit/0c9fdb5b4180c1ae800bbc8bae7a2c0620f6749b · Note
• https://github.com/apache/activemq/commit/7828069637acb2f1ca1710523f6a2b216c12c7f8 · Note
• http://securitytracker.com/id/1035328 · Note
• https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2@%3Ccommits.activemq.apache.org%3E · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1317516 · Note
• https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apache.org%3E · Note