PT-2022-22680 · Apache · Apache Activemq Artemis

Likhith Cheekatipalle + 2 · Published 2022-08-18 · Updated 2022-12-13 · CVE-2022-35278

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache ActiveMQ Artemis versions prior to 2.24.0

Description An issue exists where an attacker could display malicious content and/or redirect users to a malicious URL in the web console by using HTML in the name of an address or queue.

Recommendations For versions prior to 2.24.0, update to version 2.24.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of HTML in address or queue names to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-80

CWE-79

Related Identifiers

CVE-2022-35278

GHSA-CV6R-H2FM-PVRP

Affected Products

Apache Activemq Artemis

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2022-35278 · Security Note
• https://osv.dev/vulnerability/GHSA-cv6r-h2fm-pvrp · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-35278 · Security Note
• https://osv.dev/vulnerability/CVE-2022-35278 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-35278 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-35278 · Vendor Advisory
• https://t.me/cvenotify/35052 · Telegram Post
• https://t.me/cvenotify/39691 · Telegram Post
• https://lists.apache.org/thread/bh6y81wtotg75337bpvxcjy436zfgf3n · Note
• https://t.me/pentestingnews/27041 · Telegram Post
• https://security.netapp.com/advisory/ntap-20221209-0005 · Note
• https://t.me/cibsecurity/48586 · Telegram Post