Description
Multiple cross-site scripting (XSS) vulnerabilities in the web demos in Apache ActiveMQ before 5.8.0 allow remote attackers to inject arbitrary web script or HTML via (1) the refresh parameter to PortfolioPublishServlet.java (aka demo/portfolioPublish or Market Data Publisher), or vectors involving (2) debug logs or (3) subscribe messages in webapp/websocket/chat.js. NOTE: AMQ-4124 is covered by CVE-2012-6551.
Remediation
References
https://issues.apache.org/jira/browse/AMQ-4115
https://fisheye6.atlassian.com/changelog/activemq?cs=1399577
http://activemq.apache.org/activemq-580-release.html
https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12311210&version=12323282
http://rhn.redhat.com/errata/RHSA-2013-1029.html
http://www.securityfocus.com/bid/59400
Related Vulnerabilities
CVE-2018-8815 Vulnerability in maven package org.opencms:opencms-core
CVE-2019-10756 Vulnerability in npm package node-red-dashboard
CVE-2017-2610 Vulnerability in maven package org.jenkins-ci.main:jenkins-war
CVE-2023-32071 Vulnerability in maven package org.xwiki.platform:xwiki-platform-web-templates