logo

Database

Reflected cross-site scripting (XSS) In org.apache.activemq:activemq-web-console

Description

Apache ActiveMQ webconsole admin GUI is open to XSS In Apache ActiveMQ 5.0.0 to 5.15.11, the webconsole admin GUI is open to XSS, in the view that lists the contents of a queue.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2020-19412. NVD-2020-19413. OSV-DEBIAN-2020-19414. OSV-2020-19415. GCVE-2020-19416. SECURITY-TRACKER-CVE-2020-1941

References

1. https://github.com/apache/activemq/commit/7793a952. https://github.com/apache/activemq/commit/81bd743eaa243f0cc5dfbb1342cee1fef1fc5df23. https://github.com/apache/activemq/commit/c0e17a34. https://issues.apache.org/jira/browse/AMQ-72315. https://lists.apache.org/thread.html/r946488fb942fd35c6a6e0359f52504a558ed438574a8f14d36d7dcd7@%3Ccommits.activemq.apache.org%3E6. https://lists.apache.org/thread.html/rb2fd3bf2dce042e0ab3f3c94c4767c96bb2e7e6737624d63162df36d@%3Ccommits.activemq.apache.org%3E7. https://lists.apache.org/thread.html/re4672802b0e5ed67c08c9e77057d52138e062f77cc09581b723cf95a@%3Ccommits.activemq.apache.org%3E8. https://www.oracle.com/security-alerts/cpuApr2021.html9. https://www.oracle.com/security-alerts/cpujul2020.html10. https://www.oracle.com/security-alerts/cpujul2021.html11. https://www.oracle.com/security-alerts/cpuoct2020.html12. http://activemq.apache.org/security-advisories.data/CVE-2020-1941-announcement.txt

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.