CVE-2020-1941: Apache ActiveMQ webconsole admin GUI is open to XSS
Summary
CVE-2020-1941: Apache ActiveMQ webconsole admin GUI is open to XSS. Affects org.apache.activemq:activemq-web-console versions >= 5.0.0, < 5.15.12. Fixed in 5.15.12. How to fix ↓
Also tracked for
The same CVE-2020-1941 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache ActiveMQ is an open-source message broker that allows applications to communicate with each other through messages. It provides features such as message persistence, clustering, and high availability. The ActiveMQ webconsole admin GUI is a web-based interface that allows administrators to manage and monitor ActiveMQ instances. It provides a convenient way to view the contents of queues and perform administrative tasks. However, versions 5.0.0 to 5.15.11 of Apache ActiveMQ are vulnerable to a cross-site scripting (XSS) attack in the webconsole admin GUI. This vulnerability allows an attacker to inject malicious scripts into the view that lists the contents of a queue, potentially leading to the execution of arbitrary code in the context of the user's browser.
Vulnerability Detail
The vulnerability in Apache ActiveMQ allows an attacker to exploit the webconsole admin GUI by injecting malicious scripts into the queue view. This can be done by crafting a specially crafted payload and submitting it to the vulnerable application. When the payload is rendered in the browser, the malicious script is executed, allowing the attacker to steal sensitive information, perform actions on behalf of the user, or launch further attacks. The vulnerability has a CVSS score of 6.1, indicating a moderate severity level.
How To Fix
Latest published version: 6.3.2 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.15.12
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately possible, a temporary workaround is to disable or restrict access to the webconsole admin GUI. This can be done by modifying the configuration of the Apache ActiveMQ instance to block access to the vulnerable component. However, this workaround may limit the functionality of the application and should only be considered as a temporary measure until the upgrade can be performed.
Conclusion
In conclusion, Apache ActiveMQ versions 5.0.0 to 5.15.11 are vulnerable to a cross-site scripting (XSS) attack in the webconsole admin GUI. This vulnerability can be exploited by injecting malicious scripts into the queue view, potentially leading to the execution of arbitrary code. To mitigate this vulnerability, it is recommended to upgrade to Apache ActiveMQ version 5.15.12 or later. If immediate upgrade is not possible, restricting access to the webconsole admin GUI can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.activemq:activemq-web-console →
FAQ
Apache ActiveMQ is an open-source message broker that allows applications to communicate with each other through messages. It provides features such as message persistence, clustering, and high availability.
The webconsole admin GUI is a web-based interface that allows administrators to manage and monitor Apache ActiveMQ instances. It provides a convenient way to view the contents of queues and perform administrative tasks.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to the execution of arbitrary code in the context of the user's browser, potentially compromising their sensitive information or performing actions on their behalf.
The CVSS score of this vulnerability is 6.1, indicating a moderate severity level.
You can use Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the pom.xml file of your application.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.activemq:activemq-web-console.
