Description
Multiple cross-site scripting (XSS) vulnerabilities in the web demos in Apache ActiveMQ before 5.8.0 allow remote attackers to inject arbitrary web script or HTML via (1) the refresh parameter to PortfolioPublishServlet.java (aka demo/portfolioPublish or Market Data Publisher), or vectors involving (2) debug logs or (3) subscribe messages in webapp/websocket/chat.js. NOTE: AMQ-4124 is covered by CVE-2012-6551.
Remediation
References
http://activemq.apache.org/activemq-580-release.html
http://rhn.redhat.com/errata/RHSA-2013-1029.html
http://www.securityfocus.com/bid/59400
https://fisheye6.atlassian.com/changelog/activemq?cs=1399577
https://issues.apache.org/jira/browse/AMQ-4115
https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12311210&version=12323282
Related Vulnerabilities
CVE-2019-10078 Vulnerability in maven package org.apache.jspwiki:jspwiki-main
CVE-2020-35201 Vulnerability in maven package org.igniterealtime.openfire.plugins:bookmarks
CVE-2023-25827 Vulnerability in maven package net.opentsdb:opentsdb
CVE-2019-11003 Vulnerability in maven package org.webjars.npm:materialize-css
CVE-2020-5497 Vulnerability in maven package org.mitre:openid-connect-common