Severity: moderate
Affected versions:
- Apache ActiveMQ (org.apache.activemq:apache-activemq) before 5.19.8
- Apache ActiveMQ (org.apache.activemq:apache-activemq) 6.0.0 before 6.2.7
- Apache ActiveMQ Web Console (org.apache.activemq:apache-web-console) before
5.19.8
- Apache ActiveMQ Web Console (org.apache.activemq:apache-web-console) 6.0.0
before 6.2.7
Description:
Improper Neutralization of Input During Web Page Generation ('Cross-site
Scripting') vulnerability in Apache ActiveMQ, Apache ActiveMQ Web Console.
The browse page in the web console renders a message Id directly without
sanitization. This allows an authenticated producer to send a message with a
JMS message ID that has been crafted to contain HTML/JavaScript such that when
an administrator browses the queue in the Web Console, the payload executes in
their browser.
This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7;
Apache ActiveMQ Web Console: before 5.19.8, from 6.0.0 before 6.2.7.
Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the
issue.
Credit:
Biswajeet Ray (finder)
References:
https://activemq.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-52760
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
For further information, visit: https://activemq.apache.org/contact
