CVE-2013-1880: Apache ActiveMQ Cross-site scripting (XSS) vulnerability in the Portfolio publisher servlet
Summary
CVE-2013-1880: Apache ActiveMQ Cross-site scripting (XSS) vulnerability in the Portfolio publisher servlet. Affects org.apache.activemq:activemq-core versions < 5.9.0. Fixed in 5.9.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache ActiveMQ is an open-source message broker that implements the Java Message Service (JMS) protocol. It provides reliable messaging between distributed applications and supports various communication protocols. The Portfolio publisher servlet is part of the demo web application in Apache ActiveMQ, which allows users to publish and manage portfolios. Unfortunately, a cross-site scripting (XSS) vulnerability exists in the servlet, making it susceptible to malicious script injection.
Vulnerability Detail
The XSS vulnerability in the Portfolio publisher servlet of Apache ActiveMQ allows remote attackers to inject arbitrary web script or HTML via the refresh parameter to the demo/portfolioPublish endpoint. This can lead to the execution of malicious code in the context of other users visiting the affected page. The vulnerability was assigned CVE-2013-1880 and is considered moderate in severity according to the Common Vulnerability Scoring System (CVSS). It was first published on May 17, 2022, and last modified on August 17, 2023.
How To Fix
Minimum fixed version
5.9.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to disable or restrict access to the demo web application in Apache ActiveMQ. By preventing users from accessing the vulnerable servlet, the risk of exploitation can be mitigated. However, this is only a temporary solution, and upgrading to a patched version is still strongly advised.
Conclusion
The XSS vulnerability in the Portfolio publisher servlet of Apache ActiveMQ poses a moderate security risk. It is crucial for users to upgrade to the latest version of Apache ActiveMQ (5.9.0 or later) to mitigate the vulnerability. If immediate upgrading is not possible, restricting access to the vulnerable servlet can provide temporary protection. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.activemq:activemq-core →
FAQ
Apache ActiveMQ is an open-source message broker that implements the Java Message Service (JMS) protocol. It provides reliable messaging between distributed applications and supports various communication protocols.
The Portfolio publisher servlet is part of the demo web application in Apache ActiveMQ. It allows users to publish and manage portfolios.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to the execution of arbitrary code or the theft of sensitive information.
The XSS vulnerability in the Portfolio publisher servlet of Apache ActiveMQ allows remote attackers to inject arbitrary web script or HTML. This can lead to the execution of malicious code in the context of other users visiting the affected page.
To fix this vulnerability, it is recommended to upgrade to Apache ActiveMQ version 5.9.0 or later. This version includes a patch that addresses the XSS vulnerability in the Portfolio publisher servlet.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.activemq:activemq-core.
