Cross-Site Scripting (XSS) Vulnerability in Apache ActiveMQ
Summary
CVE-2016-0782: The administration web console in Apache ActiveMQ 5.x before 5.11.4, 5.12.x before 5.12.3, and 5.13.x before 5.13.2 allows remote authenticated users to conduct cross-site scripting (XSS) attacks and consequently obtain... Affects activemq across 29 version ranges.
< 02dcfe6ace5dd545b2d681319456430752f7f5f0
< 4ba1a1689f33d81bd2349a2bb8c66f0c95b04d1d
< 5.13.2+dfsg-1
< 6ccbbce23de1d92daf83456accfdb03a4b768238
< 11c90762b7a78a7ee43f95638d3d50d29197e471
< 17cc9c0228cf8907a40307d4dab80857f9b460f4
< 21c8b4695f771065192ed7a24c92367ed9f6e564
< 27e612bef1e471fe9fd3ecc9f2594b4c07a976fd
< 58dd93e42e7405768fd89154ff94b45ac71f151f
< 87c9bbebacfe1d2248b4a55d601f0b089d40b742
< 857e9224e90a2be58915640a2328eebe3e045b90
< 863e8a5d1ba38f262bdbec4484d704fba8e4f695
< 8938d14d434447193b02ba635606aa0fb7a80353
< 30697b4e505c77ed9c0e17720a14c78843d12c2f
< 063285ca8e142480b435c2c294f5163d1afddd5a
< 822058cbeb75d564ee20c785498f6cb38e936985
< 04992929ddb84c78390e972a352fe45064d571d5
< a6fbc32e620d02431796a9b6b77820524c44fe31
< a9eeb03520f074d5013239b8d8708a05ba31e176
< a11909d0f5caf11fd90d36ecc764f70910d81009
< abfe038ddfd6d6c4f7c41e106dabc815041b04c5
< afabcda5832fe869c47da3dc7aacb6f90face5f0
< c1fea8aa9d80a6b500006724e06e3daf86d5e2d3
< d0a64168441a08aa323a6881db444b935c186ee3
< d2dbe18cfbb36b6df142bb94c0c80396571084fc
< d60b73402cc11babb53e0a26e4537265f153492b
< e3674e70e2b1918c6e03966681d07a94e2033f86
< f81d4784f3dda08a3b71b07d7946d39d0a7c6c12
< fd4452478be6b7ef85c8409c43b017e8fbefe9e4
Fixed in 5.13.2+dfsg-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache ActiveMQ is an open-source message broker that provides reliable messaging between distributed applications. It is widely used in enterprise environments to facilitate communication between different components of a system. However, a vulnerability has been discovered in versions 5.x before 5.11.4, 5.12.x before 5.12.3, and 5.13.x before 5.13.2 of Apache ActiveMQ. This vulnerability allows remote authenticated users to conduct cross-site scripting (XSS) attacks through the administration web console, potentially leading to the disclosure of sensitive information from a Java memory dump.
Vulnerability Detail
The vulnerability, identified as CVE-2016-0782, arises due to inadequate input sanitization in the administration web console of Apache ActiveMQ. By exploiting this vulnerability, an authenticated user can inject malicious scripts into the web application, which are then executed in the context of other users accessing the affected page. This can result in the theft of sensitive information from a Java memory dump, potentially exposing confidential data.
How To Fix
Minimum fixed version
5.13.2+dfsg-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade activemqTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented by disabling or restricting access to the administration web console. This can be achieved by modifying the configuration of the web server or firewall to block access to the affected URL. However, this workaround should only be considered as a temporary measure, and upgrading to the latest version is strongly recommended for long-term security.
Conclusion
The cross-site scripting vulnerability in Apache ActiveMQ can be mitigated by upgrading to version 5.13.2 or later. It is important to promptly apply the fix to prevent the potential disclosure of sensitive information. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for activemq →
FAQ
Apache ActiveMQ is an open-source message broker that facilitates reliable messaging between distributed applications.
The vulnerability allows authenticated users to conduct cross-site scripting attacks, potentially leading to the disclosure of sensitive information from a Java memory dump.
To fix this vulnerability, upgrade to Apache ActiveMQ version 5.13.2 or later.
A temporary workaround is to disable or restrict access to the administration web console.
Not upgrading to the latest version leaves your system vulnerable to cross-site scripting attacks and potential data leakage.
References
Related vulnerabilities
Recent vulnerabilities recorded for activemq.
