Description

Cross-site scripting (XSS) vulnerability in the Portfolio publisher servlet in the demo web application in Apache ActiveMQ before 5.9.0 allows remote attackers to inject arbitrary web script or HTML via the refresh parameter to demo/portfolioPublish, a different vulnerability than CVE-2012-6092.

Remediation

References

http://rhn.redhat.com/errata/RHSA-2013-1029.html

https://bugzilla.redhat.com/show_bug.cgi?id=924447

https://issues.apache.org/jira/browse/AMQ-4398

http://www.securityfocus.com/bid/65615

Related Vulnerabilities

CVE-2023-29204 Vulnerability in maven package org.xwiki.platform:xwiki-platform-oldcore

CVE-2013-7379 Vulnerability in npm package tomato

CVE-2019-9154 Vulnerability in maven package org.webjars.npm:openpgp

CVE-2022-4520 Vulnerability in maven package org.wso2.carbon.registry:org.wso2.carbon.registry.search.ui

CVE-2014-3709 Vulnerability in maven package org.keycloak:keycloak-services

Severity

Critical

Classification

CWE-79

Tags

Exploit