The administration web console in Apache ActiveMQ 5.x before 5.11.4, 5.12.x before 5.12.3, and 5.13.x before 5.13.2 allows remote authenticated users to conduct cross-site scripting (XSS) attacks and consequently obtain sensitive information from a Java memory dump via vectors related to creating a queue.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The administration web console in Apache ActiveMQ 5.x before 5.11.4, 5.12.x before 5.12.3, and 5.13.x
    before 5.13.2 allows remote authenticated users to conduct cross-site scripting (XSS) attacks and
    consequently obtain sensitive information from a Java memory dump via vectors related to creating a queue.
    (CVE-2016-0782)

Versions of Apache ActiveMQ 5.x prior to 5.11.4, 5.12.3, or 5.13.2 are affected by a flaw that is due to missing 'X-Frame-Options' headers in HTTP responses.  This may potentially allow a context-dependent attacker to conduct a clickjacking attack.

Vladimir Ivanov (Positive Technologies) reports :

Several instances of cross-site scripting vulnerabilities were identified to be present in the web-based administration console as well as the ability to trigger a Java memory dump into an arbitrary folder. The root cause of these issues are improper user data output validation and incorrect permissions configured on Jolokia.

The version of Apache ActiveMQ running on the remote host is 5.x prior to 5.13.2. It is, therefore, affected by multiple vulnerabilities :

  - A clickjacking vulnerability exists in the web-based     administration console due to not setting the     X-Frame-Options header in HTTP responses. A remote     attacker can exploit this to trick a user into executing     administrative tasks. (CVE-2016-0734)

  - Multiple cross-site scripting vulnerabilities exists in     the web-based administration console to improper     validation of user-supplied input. A remote attacker can     exploit these, via a specially crafted request, to     execute arbitrary script code in a user's browser     session. (CVE-2016-0782)

Note that CVE-2016-0734 was partially fixed in 5.11.4 and 5.12.3 by setting the X-Frame-Options header for Servlets and JSPs but not static content. Therefore, the fix for these versions is incomplete, and it is recommended that users upgrade to 5.13.2 or later.

The version of Apache ActiveMQ running on the remote host is 5.11.x prior to 5.11.4, 5.12.x prior to 5.12.3, or 5.x prior to 5.13.1. It is, therefore, affected by multiple cross-site scripting vulnerabilities in the web-based administration console due to improper validation of user-supplied input. A remote attacker can exploit this, via a specially crafted request, to execute arbitrary script code in a user's browser session.

ID	Name	Product	Family	Severity
412835	SCA: security update for org.apache.activemq:activemq-client (GHSA-8rcq-p4gh-vmj8)	Tenable Cloud Security	SCA Checks	medium
412835	SCA: security update for org.apache.activemq:activemq-client (GHSA-8rcq-p4gh-vmj8)	Tenable Self-Hosted Container Security	SCA Checks	medium
9319	Apache ActiveMQ 5.x < 5.11.4, 5.12.x < 5.12.3, or 5.13.x < 5.13.2 XSS	Nessus Network Monitor	CGI	medium
90236	FreeBSD : activemq -- Web Console XSS (a6cc5753-f29e-11e5-b4a9-ac220bdcec59)	Nessus	FreeBSD Local Security Checks	medium
90025	Apache ActiveMQ 5.x < 5.13.2 Multiple Vulnerabilities	Nessus	CGI abuses	medium
90024	Apache ActiveMQ 5.11.x < 5.11.4 / 5.12.x < 5.12.3 / 5.13.x < 5.13.1 Web Console Multiple XSS	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2016-0782

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium