CVE-2018-8006: XSS
An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the queue.jsp page of Apache ActiveMQ versions 5.0.0 to 5.15.5. The root cause of this issue is improper data filtering of the QueueFilter parameter.
Other sources
Apache ActiveMQ is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the queues.jsp file. A remote attacker could exploit this vulnerability using the QueueFilter parameter in a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2018-8006?
The severity of CVE-2018-8006 is medium, with a severity value of 6.1.
How does CVE-2018-8006 affect Apache ActiveMQ?
CVE-2018-8006 affects Apache ActiveMQ versions 5.0.0 to 5.15.5, allowing remote attackers to execute script in a victim's web browser.
How does CVE-2018-8006 affect IBM Security Directory Suite VA?
CVE-2018-8006 affects IBM Security Directory Suite VA version 8.0.1-8.0.1.19, allowing remote attackers to execute script in a victim's web browser.
How can I fix CVE-2018-8006 in Apache ActiveMQ?
To fix CVE-2018-8006 in Apache ActiveMQ, update to a version that is not vulnerable.
How can I fix CVE-2018-8006 in IBM Security Directory Suite VA?
To fix CVE-2018-8006 in IBM Security Directory Suite VA, apply the necessary security patch or update provided by IBM.