Description
The web-based administration console in Apache ActiveMQ 5.x before 5.13.2 does not send an X-Frame-Options HTTP header, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web page that contains a (1) FRAME or (2) IFRAME element.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.activemq:activemq-client | >= 5.0.0, < 5.13.2 | 5.13.2 | GHSA-w525-w93j-rxgm |
References
- RHSA-2016:1424 vendor-advisory
- 1035327 vdb-entry
- [oss-security] 20160310 [ANNOUNCE] CVE-2016-0734: ActiveMQ Web Console - Clickjacking mailing-list
- http://activemq.apache.org/security-advisories.data/CVE-2016-0734-announcement.txt
- 84321 vdb-entry
- [activemq-commits] 20190327 svn commit: r1042639 - in /websites/production/activemq/content/activemq-website: ./ projects/artemis/download/ projects/classic/download/ projects/cms/download/ security-advisories.data/ mailing-list