Description
In Apache ActiveMQ Artemis 2.5.0 to 2.13.0, a specially crafted MQTT packet which has an XSS payload as client-id or topic name can exploit this vulnerability. The XSS payload is being injected into the admin console's browser. The XSS payload is triggered in the diagram plugin; queue node and the info section.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Apache ActiveMQ Artemis | Apache ActiveMQ Artemis 2.5.0 to 2.13.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.activemq:apache-artemis | >= 2.5.0, < 2.14.0 | 2.14.0 | GHSA-3h2h-xqr2-2jp7 |
References
- https://activemq.apache.org/security-advisories.data/CVE-2020-13932-announcement.txt
- [activemq-users] 20200721 Re: [ANNOUNCE] CVE-2020-13932 Apache ActiveMQ Artemis - Remote XSS in Web console Diagram Plugin mailing-list
- [activemq-commits] 20210127 [activemq-website] branch master updated: Publish CVE-2021-26118 mailing-list
- [activemq-commits] 20210127 [activemq-website] branch master updated: Publish CVE-2021-26117 mailing-list