CVE-2016-0734: XSS
Apache ActiveMQ could allow a remote attacker to hijack the clicking action of the victim, caused by the failure to set the X-Frame-Options header in HTTP responses by the Administrative Web console. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions.
Other sources
It was reported that the web based administration console does not set the X-Frame-Options header in HTTP responses. This allows the console to be embedded in a frame or iframe which could then be used to cause a user to perform an unintended action in the console.
Affected versions: Apache ActiveMQ 5.0.0 - 5.13.1
External Reference:
http://activemq.apache.org/security-advisories.data/CVE-2016-0734-announcement.txt
— Red Hat
The web-based administration console in Apache ActiveMQ 5.x before 5.13.2 does not send an X-Frame-Options HTTP header, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web page that contains a (1) FRAME or (2) IFRAME element.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID of this vulnerability?
The vulnerability ID of this vulnerability is CVE-2016-0734.
What is the severity rating of CVE-2016-0734?
CVE-2016-0734 has a severity rating of medium.
What software versions are affected by CVE-2016-0734?
CVE-2016-0734 affects Apache ActiveMQ versions 5.0.0 to 5.13.1.
How can an attacker exploit CVE-2016-0734?
An attacker can exploit CVE-2016-0734 by hijacking the clicking action of a victim through a malicious website.
Is there a fix available for CVE-2016-0734?
Yes, a fix is available for CVE-2016-0734 in Apache ActiveMQ version 5.13.2.