CVE-2013-1879: XSS
Apache ActiveMQ is vulnerable to cross-site scripting, caused by improper validation of user-supplied input when handling cron jobs. A remote attacker could exploit this vulnerability using specific parameters to inject malicious script into a Web page which would be executed in a victim's Web browser within the security context of the hosting Web site, once the page is viewed. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
Other sources
Cross-site scripting (XSS) vulnerability in scheduled.jsp in Apache ActiveMQ 5.8.0 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors involving the "cron of a message."
Affected Software
Event History
Frequently Asked Questions
What is CVE-2013-1879?
CVE-2013-1879 is a cross-site scripting (XSS) vulnerability in Apache ActiveMQ 5.8.0 and earlier.
How does CVE-2013-1879 impact Apache ActiveMQ?
CVE-2013-1879 allows a remote attacker to inject malicious script into a web page, which can be executed by a victim's web browser.
What is the severity of CVE-2013-1879?
CVE-2013-1879 has a severity score of 4.3 (medium).
How can I fix CVE-2013-1879?
To fix CVE-2013-1879, upgrade Apache ActiveMQ to version 5.8.1 or later.
Where can I find more information about CVE-2013-1879?
You can find more information about CVE-2013-1879 at the following references: [Red Hat Advisory](http://rhn.redhat.com/errata/RHSA-2013-1029.html), [Secunia Advisory](http://secunia.com/advisories/54073), [SecurityFocus](http://www.securityfocus.com/bid/61142).