Cross-site scripting (XSS) vulnerability in createDestination.action in Apache ActiveMQ before 5.3.1 allows remote authenticated users to inject arbitrary web script or HTML via the JMSDestination parameter in a queue action.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Cross-site scripting (XSS) vulnerability in createDestination.action in Apache ActiveMQ before 5.3.1
    allows remote authenticated users to inject arbitrary web script or HTML via the JMSDestination parameter
    in a queue action. (CVE-2010-0684)

Versions 5.x of Apache ActiveMQ prior to 5.10.1 are affected by the following vulnerabilities :

 - An unauthenticated, remote attacker can crash the broker listener by sending a packet to the same port that a message consumer or product connects to, resulting in a denial of service condition. (CVE-2014-3576)
 - An XXE (Xml eXternal Entity) injection flaw related to XPath selectors exists that is triggered during the parsing of XML data. The issue is due to an incorrectly configured XML parser accepting XML external entities from an untrusted source. By sending specially crafted XML data, a remote attacker can disclose the contents of arbitrary files. (CVE-2014-3600)
 - Two flaws exists that allow a reflected cross-site scripting (XSS) attack. The first flaw exists because the 'connection.jsp' script does not validate input to the 'connectionID' parameter before returning it to users. The second flaw exists because the 'browse.jsp' script does not validate input to the 'JMSDestination' GET parameter before returning it to users. Either of these vulnerabiltiies may allow a remote attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server.  (CVE-2014-8110)
 - A flaw exists that allows a stored cross-site scripting (XSS) attack. This flaw exists because the 'createDestination.action' script does not validate input to the 'JMSDestination' parameter before returning it to users. This may allow a remote attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server. (CVE-2010-0684)
 - A flaw exists in LDAPLoginModule in Java Authentication and Authorization Service (JAAS) that is triggered when handling an authentication attempt that contains an invalid password. This authentication attempt will be considered successful, which can allow a remote attacker to bypass authentication mechanisms. This flaw is also triggered during the handling of an authentication attempt that contains a wildcard operator in place of a username. This may allow a remote attacker to bypass authentication mechanisms (CVE-2014-3612) and can allow remote attackers to obtain credentials via a brute force attack. (CVE-2015-6524)

ID	Name	Product	Family	Type	Severity
432162	SCA: security update for org.apache.activemq:activemq-parent (GHSA-mxf7-pv8q-294h)	Tenable Cloud Security	SCA Checks	Local	low
432162	SCA: security update for org.apache.activemq:activemq-parent (GHSA-mxf7-pv8q-294h)	Tenable Self-Hosted Container Security	SCA Checks	Local	low
8961	Apache ActiveMQ 5.x < 5.10.1 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers		critical

Detections

Analytics

CVE-2010-0684

low

Tenable Plugins

low

low

critical