CVE-2012-6092: XSS
Apache ActiveMQ is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by multiple vectors. A remote attacker could exploit this vulnerability using various parameters in a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
Other sources
Multiple cross-site scripting (XSS) vulnerabilities in the web demos in Apache ActiveMQ before 5.8.0 allow remote attackers to inject arbitrary web script or HTML via (1) the refresh parameter to PortfolioPublishServlet.java (aka demo/portfolioPublish or Market Data Publisher), or vectors involving (2) debug logs or (3) subscribe messages in webapp/websocket/chat.js. NOTE: AMQ-4124 is covered by CVE-2012-6551.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is CVE-2012-6092?
CVE-2012-6092 is a vulnerability in Apache ActiveMQ that allows remote attackers to execute script in a victim's web browser.
How does CVE-2012-6092 affect Apache ActiveMQ?
CVE-2012-6092 affects Apache ActiveMQ by enabling cross-site scripting attacks, allowing remote attackers to inject and execute malicious script in a victim's web browser.
What is the severity of CVE-2012-6092?
CVE-2012-6092 has a severity rating of 4.3 (Medium).
How can I fix CVE-2012-6092?
To fix CVE-2012-6092, update Apache ActiveMQ to version 5.8.0 or later, which includes the necessary patch to address the vulnerability.
Where can I find more information about CVE-2012-6092?
You can find more information about CVE-2012-6092 on the Apache ActiveMQ website, the Red Hat Customer Portal, and the SecurityFocus website.