An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the queue.jsp page of Apache ActiveMQ versions 5.0.0 to 5.15.5. The root cause of this issue is improper data filtering of the QueueFilter parameter.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An instance of a cross-site scripting vulnerability was identified to be present in the web based     administration console on the queue.jsp page of Apache ActiveMQ versions 5.0.0 to 5.15.5. The root cause     of this issue is improper data filtering of the QueueFilter parameter. (CVE-2018-8006)

  - An instance of a cross-site scripting vulnerability was identified to be present in the web based     administration console on the queue.jsp page. The root cause of this issue is improper data filtering of     the QueueFilter parameter. (CVE-2018-8006)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - An instance of a cross-site scripting vulnerability was identified to be present in the web based
    administration console on the queue.jsp page of Apache ActiveMQ versions 5.0.0 to 5.15.5. The root cause
    of this issue is improper data filtering of the QueueFilter parameter. (CVE-2018-8006)

The version of Apache ActiveMQ running on the remote host is 5.x prior to 5.15.5. It is, therefore, affected by multiple vulnerabilities.

ID	Name	Product	Family	Severity
258256	Linux Distros Unpatched Vulnerability : CVE-2018-8006	Nessus	Misc.	medium
423227	SCA: security update for org.apache.activemq:activemq-web-console (GHSA-hvwm-2624-rp9x)	Tenable Cloud Security	SCA Checks	medium
423227	SCA: security update for org.apache.activemq:activemq-web-console (GHSA-hvwm-2624-rp9x)	Tenable Self-Hosted Container Security	SCA Checks	medium
112192	Apache ActiveMQ 5.x < 5.15.5 Multiple Vulnerabilities	Nessus	CGI abuses	critical

Detections

Analytics

CVE-2018-8006

medium

Tenable Plugins

medium

medium

medium

critical