CVE-2013-1880: XSS
Apache ActiveMQ is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the demo/portfolioPublish script. A remote attacker could exploit this vulnerability using the refresh parameter in a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
Other sources
Cross-site scripting (XSS) vulnerability in the Portfolio publisher servlet in the demo web application in Apache ActiveMQ before 5.9.0 allows remote attackers to inject arbitrary web script or HTML via the refresh parameter to demo/portfolioPublish, a different vulnerability than CVE-2012-6092.
Portfolio publisher servlet doesn't sanitize input. For example he following url in Firefox
http://localhost:8161/demo/portfolioPublish?count=1&refresh=%27%3E%3Cscript%3Ealert%28%27XSS%27%29;%3C/script%3E&stocks=IBMW&stocks=BEAS&stocks=MSFT&stocks=SUNW
will trigger JS code.
External references: https://issues.apache.org/jira/browse/AMQ-4398
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-1880?
The severity of CVE-2013-1880 is medium with a severity value of 4.3.
How does CVE-2013-1880 affect Apache ActiveMQ?
CVE-2013-1880 affects Apache ActiveMQ by allowing remote attackers to execute script in a victim's web browser.
How can I fix CVE-2013-1880 in Apache ActiveMQ?
To fix CVE-2013-1880 in Apache ActiveMQ, you need to update to version 5.9.0 or later.
Are there any known patches or fixes for CVE-2013-1880?
Yes, the remedy for CVE-2013-1880 is to update Apache ActiveMQ to version 5.9.0 or later.
What is the Common Weakness Enumeration (CWE) for CVE-2013-1880?
The Common Weakness Enumeration (CWE) for CVE-2013-1880 is CWE-79, which refers to a cross-site scripting vulnerability.