CVE-2012-6092: Cross-site Scripting in Apache ActiveMQ
Summary
CVE-2012-6092: Cross-site Scripting in Apache ActiveMQ. Affects org.apache.activemq:activemq-core versions < 5.8.0. Fixed in 5.8.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache ActiveMQ is an open-source message broker that implements the Java Message Service (JMS) specification. It provides reliable messaging between distributed applications and supports various messaging patterns. ActiveMQ includes web demos that allow users to interact with the message broker through a web interface. These demos are susceptible to multiple cross-site scripting (XSS) vulnerabilities.
Vulnerability Detail
The XSS vulnerabilities in Apache ActiveMQ web demos allow remote attackers to inject arbitrary web script or HTML. The first vulnerability involves the 'refresh' parameter in the 'PortfolioPublishServlet.java' demo, also known as 'demo/portfolioPublish' or 'Market Data Publisher'. The other vectors include debug logs and subscribe messages in 'webapp/websocket/chat.js'. These vulnerabilities can be exploited to execute malicious scripts or steal sensitive information from users accessing the affected web demos.
How To Fix
Minimum fixed version
5.8.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable or restrict access to the vulnerable web demos in Apache ActiveMQ. This can be achieved by modifying the configuration or access controls to prevent unauthorized access to the affected components. However, applying the official fix by upgrading to a patched version is the recommended solution.
Conclusion
The XSS vulnerabilities in Apache ActiveMQ web demos pose a risk of remote code execution and data theft. It is crucial to upgrade to version 5.8.0 or later to address these vulnerabilities. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.activemq:activemq-core →
FAQ
Apache ActiveMQ is an open-source message broker that implements the Java Message Service (JMS) specification. It facilitates reliable messaging between distributed applications.
Versions prior to 5.8.0 of Apache ActiveMQ are affected by the XSS vulnerabilities in the web demos.
The vulnerabilities allow remote attackers to inject malicious scripts or HTML into the web demos, potentially leading to the execution of arbitrary code or theft of sensitive information from users.
To fix the vulnerability, it is recommended to upgrade Apache ActiveMQ to version 5.8.0 or later, which includes the necessary patches to mitigate the XSS vulnerabilities.
As a temporary workaround, users can disable or restrict access to the vulnerable web demos in Apache ActiveMQ. However, applying the official fix by upgrading to a patched version is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.activemq:activemq-core.
