CVE-2018-8006 — Apache ActiveMQ web console vulnerable to Cross-site Scripting

Description

An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the queue.jsp page of Apache ActiveMQ versions 5.0.0 to 5.15.5. The root cause of this issue is improper data filtering of the QueueFilter parameter.

Affected products

Vendor	Product	Affected	Fixed
Apache Software Foundation	Apache ActiveMQ	5.0.0 to 5.15.5	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 13	activemq	5.15.6-1	—
Debian 12	activemq	5.15.6-1	—

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu Pro 16.04 LTS	activemq	No fix yet	—

Automated scanner template

A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.

Apache ActiveMQ <=5.15.5 - Cross-Site Scripting http/cves/2018/CVE-2018-8006.yaml

Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.apache.activemq:activemq-web-console	>= 5.0.0, < 5.15.6	5.15.6	GHSA-hvwm-2624-rp9x

Apache ActiveMQ web console vulnerable to Cross-site Scripting