GHSA-9cvr-8xq4-2m73

Improper Neutralization of Input During Web Page Generation in Apache ActiveMQ

Source: GitHub Advisory Database (reviewed) Moderate CVE-2014-8110

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.apache.activemq:activemq-client	>= 5.0.0, < 5.10.1	5.10.1

Details

As written in the advisory (Markdown source, shown as plain text).

Multiple cross-site scripting (XSS) vulnerabilities in the web based administration console in Apache ActiveMQ 5.x before 5.10.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2014-8110 advisory
https://github.com/apache/activemq/commit/994d9b26 web
https://github.com/apache/activemq/commit/f8b3de86d8154db5680433e46734b2bd9ced852b web
https://exchange.xforce.ibmcloud.com/vulnerabilities/100724 web
https://github.com/apache/activemq package
https://issues.apache.org/jira/browse/AMQ-5033 web
https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apache.org%3E web
https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2@%3Ccommits.activemq.apache.org%3E web
https://web.archive.org/web/20161110092459/http://secunia.com/advisories/62649 web
https://web.archive.org/web/20200228044455/http://www.securityfocus.com/bid/72511 web
http://activemq.apache.org/security-advisories.data/CVE-2014-8110-announcement.txt web
http://seclists.org/oss-sec/2015/q1/427 web