Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS04cmNxLXA0Z2gtdm1qOM4AATvJ

Improper Neutralization of Input During Web Page Generation in Apache ActiveMQ

The administration web console in Apache ActiveMQ 5.x before 5.11.4, 5.12.x before 5.12.3, and 5.13.x before 5.13.2 allows remote authenticated users to conduct cross-site scripting (XSS) attacks and consequently obtain sensitive information from a Java memory dump via vectors related to creating a queue.

Permalink: https://github.com/advisories/GHSA-8rcq-p4gh-vmj8
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS04cmNxLXA0Z2gtdm1qOM4AATvJ
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: almost 2 years ago
Updated: about 1 month ago


CVSS Score: 5.4
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Identifiers: GHSA-8rcq-p4gh-vmj8, CVE-2016-0782
References: Repository: https://github.com/apache/activemq
Blast Radius: 20.6

Affected Packages

maven:org.apache.activemq:activemq-client
Dependent packages: 410
Dependent repositories: 6,414
Downloads:
Affected Version Ranges: >= 5.13.0, <= 5.13.1, >= 5.12.0, <= 5.12.2, >= 5.0.0, <= 5.11.3
Fixed in: 5.13.2, 5.12.3, 5.11.4
All affected versions: 5.8.0, 5.9.0, 5.9.1, 5.10.0, 5.10.1, 5.10.2, 5.11.0, 5.11.1, 5.11.2, 5.11.3, 5.12.0, 5.12.1, 5.12.2, 5.13.0, 5.13.1
All unaffected versions: 5.11.4, 5.12.3, 5.13.2, 5.13.3, 5.13.4, 5.13.5, 5.14.0, 5.14.1, 5.14.2, 5.14.3, 5.14.4, 5.14.5, 5.15.0, 5.15.1, 5.15.2, 5.15.3, 5.15.4, 5.15.5, 5.15.6, 5.15.7, 5.15.8, 5.15.9, 5.15.10, 5.15.11, 5.15.12, 5.15.13, 5.15.14, 5.15.15, 5.15.16, 5.16.0, 5.16.1, 5.16.2, 5.16.3, 5.16.4, 5.16.5, 5.16.6, 5.16.7, 5.17.0, 5.17.1, 5.17.2, 5.17.3, 5.17.4, 5.17.5, 5.17.6, 5.18.0, 5.18.1, 5.18.2, 5.18.3, 5.18.4, 6.0.0, 6.0.1, 6.1.0, 6.1.1, 6.1.2