Description
Cross-site scripting (XSS) vulnerability in createDestination.action in Apache ActiveMQ before 5.3.1 allows remote authenticated users to inject arbitrary web script or HTML via the JMSDestination parameter in a queue action.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.activemq:activemq-parent | < 5.3.1 | 5.3.1 | GHSA-mxf7-pv8q-294h |
References
- https://issues.apache.org/activemq/browse/AMQ-2613
- 20100330 CVE-2010-0684: Apache ActiveMQ Persistent Cross-Site Scripting (XSS) Vulnerability mailing-list
- 1023778 vdb-entry
- activemq-createdestination-xss(57397) vdb-entry
- http://activemq.apache.org/activemq-531-release.html
- 39119 vdb-entry
- 39223 third-party-advisory
- https://issues.apache.org/activemq/browse/AMQ-2625
- http://www.rajatswarup.com/CVE-2010-0684.txt