An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the message.jsp page of Apache ActiveMQ versions 5.15.12 through 5.16.0.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An instance of a cross-site scripting vulnerability was identified to be present in the web based     administration console on the message.jsp page of Apache ActiveMQ versions 5.15.12 through 5.16.0.
    (CVE-2020-13947)

  - An instance of a cross-site scriptingvulnerability was identified to be present in the web     basedadministration console on the message.jsp page of Apache ActiveMQversions prior to 5.15.14 and     5.16.1. (CVE-2020-13947)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - An instance of a cross-site scripting vulnerability was identified to be present in the web based
    administration console on the message.jsp page of Apache ActiveMQ versions 5.15.12 through 5.16.0.
    (CVE-2020-13947)

The version of Apache ActiveMQ running on the remote host is 5.x prior to 5.15.14 or 5.16.x prior to 5.16.1. It is, therefore, affected by multiple vulnerabilities including the following: 

  - An authentication bypass vulnerability. The optional ActiveMQ LDAP login module can be configured   to use anonymous access to the LDAP server. In this case, for Apache ActiveMQ prior to versions 5.16.1 and   5.15.14, the anonymous context is used to verify a valid users password in error, resulting in no check on   the password. (CVE-2021-26117)

  - A cross-site scripting (XSS) vulnerability exists in Apache ActiveMQ due to improper validation of   user-supplied input before returning it to users. An unauthenticated, remote attacker can exploit this,   by convincing a user to click a specially crafted URL, to execute arbitrary script code in a user's browser   session. (CVE-2020-13947)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
257636	Linux Distros Unpatched Vulnerability : CVE-2020-13947	Nessus	Misc.	medium
411242	SCA: security update for org.apache.activemq:activemq-parent (GHSA-66gw-ch5v-74v8)	Tenable Cloud Security	SCA Checks	medium
411242	SCA: security update for org.apache.activemq:activemq-parent (GHSA-66gw-ch5v-74v8)	Tenable Self-Hosted Container Security	SCA Checks	medium
146087	Apache ActiveMQ 5.x < 5.15.14 / 5.16.x < 5.16.1 Multiple Vulnerabilities	Nessus	CGI abuses	high

Detections

Analytics

CVE-2020-13947

medium

Tenable Plugins

medium

medium

medium

high