CVE-2016-0782: XSS
Apache ActiveMQ is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the web based administration console. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
Other sources
Several instances of cross-site scripting vulnerabilities were identified to be present in the web based administration console as well as the ability to trigger a Java memory dump into an arbitrary folder. The root cause of these issues are improper user data output validation and incorrect permissions configured on Jolokia.
Affected versions: ActiveMQ 5.0.0 - 5.13.1
External Reference:
http://activemq.apache.org/security-advisories.data/CVE-2016-0782-announcement.txt
— Red Hat
The administration web console in Apache ActiveMQ 5.x before 5.11.4, 5.12.x before 5.12.3, and 5.13.x before 5.13.2 allows remote authenticated users to conduct cross-site scripting (XSS) attacks and consequently obtain sensitive information from a Java memory dump via vectors related to creating a queue.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is CVE-2016-0782?
CVE-2016-0782 is a vulnerability in Apache ActiveMQ that allows remote attackers to execute script in a victim's web browser.
How does CVE-2016-0782 work?
CVE-2016-0782 works by exploiting a cross-site scripting vulnerability in the web based administration console of Apache ActiveMQ.
Which versions of Apache ActiveMQ are affected by CVE-2016-0782?
Apache ActiveMQ versions 5.1.0 to 5.13.1 are affected by CVE-2016-0782.
What is the severity of CVE-2016-0782?
CVE-2016-0782 has a severity rating of 6.1, which is considered medium.
How can CVE-2016-0782 be fixed?
To fix CVE-2016-0782, users should upgrade to Apache ActiveMQ version 5.11.4, 5.12.3, or 5.13.2.