cvelistv5 - cve-2016-0782

CVE-2016-0782 (GCVE-0-2016-0782)

Vulnerability from cvelistv5

Published

2016-08-05 15:00

Modified

2024-08-05 22:30

Severity ?

CWE

Summary

The administration web console in Apache ActiveMQ 5.x before 5.11.4, 5.12.x before 5.12.3, and 5.13.x before 5.13.2 allows remote authenticated users to conduct cross-site scripting (XSS) attacks and consequently obtain sensitive information from a Java memory dump via vectors related to creating a queue.

References

URL

	Vendor	Product	Version
	n/a	n/a	Version: n/a

RHSA-2016:1424

Vulnerability from csaf_redhat

Published

2016-07-13 19:44

Modified

2025-11-21 17:56

Summary

Red Hat Security Advisory: Red Hat JBoss Fuse/A-MQ 6.2.1 security and bug fix update

Notes

Topic

Red Hat JBoss Fuse and A-MQ 6.2.1 Rollup Patch 3, which fixes two security issues and includes several bug fixes and various enhancements, is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details

Red Hat JBoss Fuse, based on Apache ServiceMix, provides a small-footprint, flexible, open source enterprise service bus and integration platform. Red Hat JBoss A-MQ, based on Apache ActiveMQ, is a standards compliant messaging system that is tailored for use in mission critical applications. This patch is an update to Red Hat JBoss Fuse 6.2.1 and Red Hat JBoss A-MQ 6.2.1. It includes several bug fixes, which are documented in the readme.txt file included with the patch files. Security Fix(es): * It was reported that the web based administration console does not set the X-Frame-Options header in HTTP responses. This allows the console to be embedded in a frame or iframe which could then be used to cause a user to perform an unintended action in the console. (CVE-2016-0734) * It was found that Apache Active MQ administration web console did not validate input correctly when creating a queue. An authenticated attacker could exploit this flaw via cross-site scripting and use it to access sensitive information or further attacks. (CVE-2016-0782) Refer to the readme.txt file included with the patch files for installation instructions.

This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat JBoss Fuse and A-MQ 6.2.1 Rollup Patch 3, which fixes two security issues and includes several bug fixes and various enhancements, is now available from the Red Hat Customer Portal.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat JBoss Fuse, based on Apache ServiceMix, provides a small-footprint, flexible, open source enterprise service bus and integration platform. Red Hat JBoss A-MQ, based on Apache ActiveMQ, is a standards compliant messaging system that is tailored for use in mission critical applications.\n\nThis patch is an update to Red Hat JBoss Fuse 6.2.1 and Red Hat JBoss A-MQ 6.2.1. It includes several bug fixes, which are documented in the readme.txt file included with the patch files.\n\nSecurity Fix(es):\n\n* It was reported that the web based administration console does not set the X-Frame-Options header in HTTP responses. This allows the console to be embedded in a frame or iframe which could then be used to cause a user to perform an unintended action in the console. (CVE-2016-0734)\n\n* It was found that Apache Active MQ administration web console did not validate input correctly when creating a queue. An authenticated attacker could exploit this flaw via cross-site scripting and use it to access sensitive information or further attacks. (CVE-2016-0782)\n\nRefer to the readme.txt file included with the patch files for installation instructions.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2016:1424",
        "url": "https://access.redhat.com/errata/RHSA-2016:1424"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.fuse\u0026downloadType=securityPatches\u0026version=6.2.1",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.fuse\u0026downloadType=securityPatches\u0026version=6.2.1"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.amq\u0026downloadType=securityPatches\u0026version=6.2.1",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.amq\u0026downloadType=securityPatches\u0026version=6.2.1"
      },
      {
        "category": "external",
        "summary": "1317516",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1317516"
      },
      {
        "category": "external",
        "summary": "1317520",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1317520"
      },
      {
        "category": "external",
        "summary": "ENTMQ-1665",
        "url": "https://issues.redhat.com/browse/ENTMQ-1665"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1424.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat JBoss Fuse/A-MQ 6.2.1 security and bug fix update",
    "tracking": {
      "current_release_date": "2025-11-21T17:56:44+00:00",
      "generator": {
        "date": "2025-11-21T17:56:44+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.6.12"
        }
      },
      "id": "RHSA-2016:1424",
      "initial_release_date": "2016-07-13T19:44:16+00:00",
      "revision_history": [
        {
          "date": "2016-07-13T19:44:16+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2019-02-20T12:38:39+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2025-11-21T17:56:44+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss A-MQ 6.2",
                "product": {
                  "name": "Red Hat JBoss A-MQ 6.2",
                  "product_id": "Red Hat JBoss A-MQ 6.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_amq:6.2"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat JBoss Fuse 6.2",
                "product": {
                  "name": "Red Hat JBoss Fuse 6.2",
                  "product_id": "Red Hat JBoss Fuse 6.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_fuse:6.2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Fuse"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Naftali Rosenbaum"
          ],
          "organization": "Comsec Consulting"
        }
      ],
      "cve": "CVE-2015-5184",
      "discovery_date": "2015-04-27T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1249183"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that the Hawtio console setting for the Access-Control-Allow-Origin header permits unrestricted sharing (allow all). An attacker could use this flaw to access sensitive information or perform other attacks.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Console: CORS headers set to allow all in Red Hat AMQ",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw affects only the Red Hat AMQ Product, and does not impact Apache ActiveMQ.",
          "title": "Statement"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss A-MQ 6.2",
          "Red Hat JBoss Fuse 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2015-5184"
        },
        {
          "category": "external",
          "summary": "RHBZ#1249183",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1249183"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2015-5184",
          "url": "https://www.cve.org/CVERecord?id=CVE-2015-5184"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-5184",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5184"
        }
      ],
      "release_date": "2015-10-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2016-07-13T19:44:16+00:00",
          "details": "The References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat JBoss A-MQ 6.2",
            "Red Hat JBoss Fuse 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2016:1424"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "Console: CORS headers set to allow all in Red Hat AMQ"
    },
    {
      "cve": "CVE-2016-0734",
      "discovery_date": "2016-03-10T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1317520"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was reported that the web based administration console does not set the X-Frame-Options header in HTTP responses. This allows the console to be embedded in a frame or iframe which could then be used to cause a user to perform an unintended action in the console.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "activemq: Clickjacking in Web Console",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss A-MQ 6.2",
          "Red Hat JBoss Fuse 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2016-0734"
        },
        {
          "category": "external",
          "summary": "RHBZ#1317520",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1317520"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2016-0734",
          "url": "https://www.cve.org/CVERecord?id=CVE-2016-0734"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-0734",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0734"
        },
        {
          "category": "external",
          "summary": "http://activemq.apache.org/security-advisories.data/CVE-2016-0734-announcement.txt",
          "url": "http://activemq.apache.org/security-advisories.data/CVE-2016-0734-announcement.txt"
        }
      ],
      "release_date": "2016-03-10T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2016-07-13T19:44:16+00:00",
          "details": "The References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat JBoss A-MQ 6.2",
            "Red Hat JBoss Fuse 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2016:1424"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "Red Hat JBoss A-MQ 6.2",
            "Red Hat JBoss Fuse 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "activemq: Clickjacking in Web Console"
    },
    {
      "cve": "CVE-2016-0782",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2016-03-10T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1317516"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that Apache Active MQ administration web console did not validate input correctly when creating a queue. An authenticated attacker could exploit this flaw via cross-site scripting and use it to access sensitive information or further attacks.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "activemq: Cross-site scripting vulnerabilities in web console",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss A-MQ 6.2",
          "Red Hat JBoss Fuse 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2016-0782"
        },
        {
          "category": "external",
          "summary": "RHBZ#1317516",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1317516"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2016-0782",
          "url": "https://www.cve.org/CVERecord?id=CVE-2016-0782"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-0782",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0782"
        },
        {
          "category": "external",
          "summary": "http://activemq.apache.org/security-advisories.data/CVE-2016-0782-announcement.txt",
          "url": "http://activemq.apache.org/security-advisories.data/CVE-2016-0782-announcement.txt"
        }
      ],
      "release_date": "2016-03-10T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2016-07-13T19:44:16+00:00",
          "details": "The References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat JBoss A-MQ 6.2",
            "Red Hat JBoss Fuse 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2016:1424"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "NONE",
            "baseScore": 3.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:M/Au:S/C:P/I:N/A:N",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "Red Hat JBoss A-MQ 6.2",
            "Red Hat JBoss Fuse 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "activemq: Cross-site scripting vulnerabilities in web console"
    }
  ]
}

rhsa-2016:1424

Vulnerability from csaf_redhat

Published

2016-07-13 19:44

Modified

2025-11-21 17:56

Summary

Red Hat Security Advisory: Red Hat JBoss Fuse/A-MQ 6.2.1 security and bug fix update

Notes

Topic

Details

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat JBoss Fuse and A-MQ 6.2.1 Rollup Patch 3, which fixes two security issues and includes several bug fixes and various enhancements, is now available from the Red Hat Customer Portal.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat JBoss Fuse, based on Apache ServiceMix, provides a small-footprint, flexible, open source enterprise service bus and integration platform. Red Hat JBoss A-MQ, based on Apache ActiveMQ, is a standards compliant messaging system that is tailored for use in mission critical applications.\n\nThis patch is an update to Red Hat JBoss Fuse 6.2.1 and Red Hat JBoss A-MQ 6.2.1. It includes several bug fixes, which are documented in the readme.txt file included with the patch files.\n\nSecurity Fix(es):\n\n* It was reported that the web based administration console does not set the X-Frame-Options header in HTTP responses. This allows the console to be embedded in a frame or iframe which could then be used to cause a user to perform an unintended action in the console. (CVE-2016-0734)\n\n* It was found that Apache Active MQ administration web console did not validate input correctly when creating a queue. An authenticated attacker could exploit this flaw via cross-site scripting and use it to access sensitive information or further attacks. (CVE-2016-0782)\n\nRefer to the readme.txt file included with the patch files for installation instructions.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2016:1424",
        "url": "https://access.redhat.com/errata/RHSA-2016:1424"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.fuse\u0026downloadType=securityPatches\u0026version=6.2.1",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.fuse\u0026downloadType=securityPatches\u0026version=6.2.1"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.amq\u0026downloadType=securityPatches\u0026version=6.2.1",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.amq\u0026downloadType=securityPatches\u0026version=6.2.1"
      },
      {
        "category": "external",
        "summary": "1317516",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1317516"
      },
      {
        "category": "external",
        "summary": "1317520",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1317520"
      },
      {
        "category": "external",
        "summary": "ENTMQ-1665",
        "url": "https://issues.redhat.com/browse/ENTMQ-1665"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1424.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat JBoss Fuse/A-MQ 6.2.1 security and bug fix update",
    "tracking": {
      "current_release_date": "2025-11-21T17:56:44+00:00",
      "generator": {
        "date": "2025-11-21T17:56:44+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.6.12"
        }
      },
      "id": "RHSA-2016:1424",
      "initial_release_date": "2016-07-13T19:44:16+00:00",
      "revision_history": [
        {
          "date": "2016-07-13T19:44:16+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2019-02-20T12:38:39+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2025-11-21T17:56:44+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss A-MQ 6.2",
                "product": {
                  "name": "Red Hat JBoss A-MQ 6.2",
                  "product_id": "Red Hat JBoss A-MQ 6.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_amq:6.2"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat JBoss Fuse 6.2",
                "product": {
                  "name": "Red Hat JBoss Fuse 6.2",
                  "product_id": "Red Hat JBoss Fuse 6.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_fuse:6.2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Fuse"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Naftali Rosenbaum"
          ],
          "organization": "Comsec Consulting"
        }
      ],
      "cve": "CVE-2015-5184",
      "discovery_date": "2015-04-27T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1249183"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that the Hawtio console setting for the Access-Control-Allow-Origin header permits unrestricted sharing (allow all). An attacker could use this flaw to access sensitive information or perform other attacks.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Console: CORS headers set to allow all in Red Hat AMQ",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw affects only the Red Hat AMQ Product, and does not impact Apache ActiveMQ.",
          "title": "Statement"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss A-MQ 6.2",
          "Red Hat JBoss Fuse 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2015-5184"
        },
        {
          "category": "external",
          "summary": "RHBZ#1249183",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1249183"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2015-5184",
          "url": "https://www.cve.org/CVERecord?id=CVE-2015-5184"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-5184",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5184"
        }
      ],
      "release_date": "2015-10-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2016-07-13T19:44:16+00:00",
          "details": "The References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat JBoss A-MQ 6.2",
            "Red Hat JBoss Fuse 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2016:1424"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "Console: CORS headers set to allow all in Red Hat AMQ"
    },
    {
      "cve": "CVE-2016-0734",
      "discovery_date": "2016-03-10T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1317520"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was reported that the web based administration console does not set the X-Frame-Options header in HTTP responses. This allows the console to be embedded in a frame or iframe which could then be used to cause a user to perform an unintended action in the console.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "activemq: Clickjacking in Web Console",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss A-MQ 6.2",
          "Red Hat JBoss Fuse 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2016-0734"
        },
        {
          "category": "external",
          "summary": "RHBZ#1317520",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1317520"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2016-0734",
          "url": "https://www.cve.org/CVERecord?id=CVE-2016-0734"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-0734",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0734"
        },
        {
          "category": "external",
          "summary": "http://activemq.apache.org/security-advisories.data/CVE-2016-0734-announcement.txt",
          "url": "http://activemq.apache.org/security-advisories.data/CVE-2016-0734-announcement.txt"
        }
      ],
      "release_date": "2016-03-10T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2016-07-13T19:44:16+00:00",
          "details": "The References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat JBoss A-MQ 6.2",
            "Red Hat JBoss Fuse 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2016:1424"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "Red Hat JBoss A-MQ 6.2",
            "Red Hat JBoss Fuse 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "activemq: Clickjacking in Web Console"
    },
    {
      "cve": "CVE-2016-0782",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2016-03-10T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1317516"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that Apache Active MQ administration web console did not validate input correctly when creating a queue. An authenticated attacker could exploit this flaw via cross-site scripting and use it to access sensitive information or further attacks.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "activemq: Cross-site scripting vulnerabilities in web console",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss A-MQ 6.2",
          "Red Hat JBoss Fuse 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2016-0782"
        },
        {
          "category": "external",
          "summary": "RHBZ#1317516",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1317516"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2016-0782",
          "url": "https://www.cve.org/CVERecord?id=CVE-2016-0782"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-0782",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0782"
        },
        {
          "category": "external",
          "summary": "http://activemq.apache.org/security-advisories.data/CVE-2016-0782-announcement.txt",
          "url": "http://activemq.apache.org/security-advisories.data/CVE-2016-0782-announcement.txt"
        }
      ],
      "release_date": "2016-03-10T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2016-07-13T19:44:16+00:00",
          "details": "The References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat JBoss A-MQ 6.2",
            "Red Hat JBoss Fuse 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2016:1424"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "NONE",
            "baseScore": 3.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:M/Au:S/C:P/I:N/A:N",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "Red Hat JBoss A-MQ 6.2",
            "Red Hat JBoss Fuse 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "activemq: Cross-site scripting vulnerabilities in web console"
    }
  ]
}

rhsa-2016_1424

Vulnerability from csaf_redhat

Published

2016-07-13 19:44

Modified

2024-11-22 10:13

Summary

Red Hat Security Advisory: Red Hat JBoss Fuse/A-MQ 6.2.1 security and bug fix update

Notes

Topic

Details

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat JBoss Fuse and A-MQ 6.2.1 Rollup Patch 3, which fixes two security issues and includes several bug fixes and various enhancements, is now available from the Red Hat Customer Portal.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat JBoss Fuse, based on Apache ServiceMix, provides a small-footprint, flexible, open source enterprise service bus and integration platform. Red Hat JBoss A-MQ, based on Apache ActiveMQ, is a standards compliant messaging system that is tailored for use in mission critical applications.\n\nThis patch is an update to Red Hat JBoss Fuse 6.2.1 and Red Hat JBoss A-MQ 6.2.1. It includes several bug fixes, which are documented in the readme.txt file included with the patch files.\n\nSecurity Fix(es):\n\n* It was reported that the web based administration console does not set the X-Frame-Options header in HTTP responses. This allows the console to be embedded in a frame or iframe which could then be used to cause a user to perform an unintended action in the console. (CVE-2016-0734)\n\n* It was found that Apache Active MQ administration web console did not validate input correctly when creating a queue. An authenticated attacker could exploit this flaw via cross-site scripting and use it to access sensitive information or further attacks. (CVE-2016-0782)\n\nRefer to the readme.txt file included with the patch files for installation instructions.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2016:1424",
        "url": "https://access.redhat.com/errata/RHSA-2016:1424"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.fuse\u0026downloadType=securityPatches\u0026version=6.2.1",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.fuse\u0026downloadType=securityPatches\u0026version=6.2.1"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.amq\u0026downloadType=securityPatches\u0026version=6.2.1",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.amq\u0026downloadType=securityPatches\u0026version=6.2.1"
      },
      {
        "category": "external",
        "summary": "1317516",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1317516"
      },
      {
        "category": "external",
        "summary": "1317520",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1317520"
      },
      {
        "category": "external",
        "summary": "ENTMQ-1665",
        "url": "https://issues.redhat.com/browse/ENTMQ-1665"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1424.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat JBoss Fuse/A-MQ 6.2.1 security and bug fix update",
    "tracking": {
      "current_release_date": "2024-11-22T10:13:26+00:00",
      "generator": {
        "date": "2024-11-22T10:13:26+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2016:1424",
      "initial_release_date": "2016-07-13T19:44:16+00:00",
      "revision_history": [
        {
          "date": "2016-07-13T19:44:16+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2019-02-20T12:38:39+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-22T10:13:26+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss A-MQ 6.2",
                "product": {
                  "name": "Red Hat JBoss A-MQ 6.2",
                  "product_id": "Red Hat JBoss A-MQ 6.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_amq:6.2"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat JBoss Fuse 6.2",
                "product": {
                  "name": "Red Hat JBoss Fuse 6.2",
                  "product_id": "Red Hat JBoss Fuse 6.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_fuse:6.2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Fuse"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Naftali Rosenbaum"
          ],
          "organization": "Comsec Consulting"
        }
      ],
      "cve": "CVE-2015-5184",
      "discovery_date": "2015-04-27T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1249183"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that the Hawtio console setting for the Access-Control-Allow-Origin header permits unrestricted sharing (allow all). An attacker could use this flaw to access sensitive information or perform other attacks.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Console: CORS headers set to allow all in Red Hat AMQ",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw affects only the Red Hat AMQ Product, and does not impact Apache ActiveMQ.",
          "title": "Statement"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss A-MQ 6.2",
          "Red Hat JBoss Fuse 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2015-5184"
        },
        {
          "category": "external",
          "summary": "RHBZ#1249183",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1249183"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2015-5184",
          "url": "https://www.cve.org/CVERecord?id=CVE-2015-5184"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-5184",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5184"
        }
      ],
      "release_date": "2015-10-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2016-07-13T19:44:16+00:00",
          "details": "The References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat JBoss A-MQ 6.2",
            "Red Hat JBoss Fuse 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2016:1424"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "Console: CORS headers set to allow all in Red Hat AMQ"
    },
    {
      "cve": "CVE-2016-0734",
      "discovery_date": "2016-03-10T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1317520"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was reported that the web based administration console does not set the X-Frame-Options header in HTTP responses. This allows the console to be embedded in a frame or iframe which could then be used to cause a user to perform an unintended action in the console.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "activemq: Clickjacking in Web Console",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss A-MQ 6.2",
          "Red Hat JBoss Fuse 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2016-0734"
        },
        {
          "category": "external",
          "summary": "RHBZ#1317520",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1317520"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2016-0734",
          "url": "https://www.cve.org/CVERecord?id=CVE-2016-0734"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-0734",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0734"
        },
        {
          "category": "external",
          "summary": "http://activemq.apache.org/security-advisories.data/CVE-2016-0734-announcement.txt",
          "url": "http://activemq.apache.org/security-advisories.data/CVE-2016-0734-announcement.txt"
        }
      ],
      "release_date": "2016-03-10T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2016-07-13T19:44:16+00:00",
          "details": "The References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat JBoss A-MQ 6.2",
            "Red Hat JBoss Fuse 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2016:1424"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "Red Hat JBoss A-MQ 6.2",
            "Red Hat JBoss Fuse 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "activemq: Clickjacking in Web Console"
    },
    {
      "cve": "CVE-2016-0782",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2016-03-10T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1317516"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that Apache Active MQ administration web console did not validate input correctly when creating a queue. An authenticated attacker could exploit this flaw via cross-site scripting and use it to access sensitive information or further attacks.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "activemq: Cross-site scripting vulnerabilities in web console",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss A-MQ 6.2",
          "Red Hat JBoss Fuse 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2016-0782"
        },
        {
          "category": "external",
          "summary": "RHBZ#1317516",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1317516"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2016-0782",
          "url": "https://www.cve.org/CVERecord?id=CVE-2016-0782"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-0782",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0782"
        },
        {
          "category": "external",
          "summary": "http://activemq.apache.org/security-advisories.data/CVE-2016-0782-announcement.txt",
          "url": "http://activemq.apache.org/security-advisories.data/CVE-2016-0782-announcement.txt"
        }
      ],
      "release_date": "2016-03-10T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2016-07-13T19:44:16+00:00",
          "details": "The References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat JBoss A-MQ 6.2",
            "Red Hat JBoss Fuse 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2016:1424"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "NONE",
            "baseScore": 3.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:M/Au:S/C:P/I:N/A:N",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "Red Hat JBoss A-MQ 6.2",
            "Red Hat JBoss Fuse 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "activemq: Cross-site scripting vulnerabilities in web console"
    }
  ]
}

cnvd-2016-01695

Vulnerability from cnvd

Title

Apache ActiveMQ Web Console跨站脚本漏洞

Description

Apache ActiveMQ是流行的消息传输和集成模式提供程序。 Apache ActiveMQ 5.0.0 - 5.13.1在Web管理控制台中及Java内存转储中存在多个跨站脚本漏洞，由于用户数据输出验证错误，Jolokia内权限设置不当。允许攻击者利用此漏洞进行跨站脚本攻击。

Severity

中

Patch Name

Apache ActiveMQ Web Console跨站脚本漏洞的补丁

Patch Description

Apache ActiveMQ是流行的消息传输和集成模式提供程序。 Apache ActiveMQ 5.0.0 - 5.13.1在Web管理控制台中及Java内存转储中存在多个跨站脚本漏洞，由于用户数据输出验证错误，Jolokia内权限设置不当。允许攻击者利用此漏洞进行跨站脚本攻击。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://activemq.apache.org/security-advisories.data/CVE-2016-0782-announcement.txt

Reference

http://activemq.apache.org/security-advisories.data/CVE-2016-0782-announcement.txt

Impacted products

Name
Apache ActiveMQ 5.0.0 - 5.13.1

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2016-0782"
    }
  },
  "description": "Apache ActiveMQ\u662f\u6d41\u884c\u7684\u6d88\u606f\u4f20\u8f93\u548c\u96c6\u6210\u6a21\u5f0f\u63d0\u4f9b\u7a0b\u5e8f\u3002\r\n\r\nApache ActiveMQ 5.0.0 - 5.13.1\u5728Web\u7ba1\u7406\u63a7\u5236\u53f0\u4e2d\u53caJava\u5185\u5b58\u8f6c\u50a8\u4e2d\u5b58\u5728\u591a\u4e2a\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\uff0c\u7531\u4e8e\u7528\u6237\u6570\u636e\u8f93\u51fa\u9a8c\u8bc1\u9519\u8bef\uff0cJolokia\u5185\u6743\u9650\u8bbe\u7f6e\u4e0d\u5f53\u3002\u5141\u8bb8\u653b\u51fb\u8005\u5229\u7528\u6b64\u6f0f\u6d1e\u8fdb\u884c\u8de8\u7ad9\u811a\u672c\u653b\u51fb\u3002",
  "discovererName": "Vladimir Ivanov (Positive Technologies)",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u7ecf\u53d1\u5e03\u4e86\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u8fd9\u4e2a\u5b89\u5168\u95ee\u9898\uff0c\u8bf7\u5230\u5382\u5546\u7684\u4e3b\u9875\u4e0b\u8f7d\uff1a\r\nhttp://activemq.apache.org/security-advisories.data/CVE-2016-0782-announcement.txt",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2016-01695",
  "openTime": "2016-03-16",
  "patchDescription": "Apache ActiveMQ\u662f\u6d41\u884c\u7684\u6d88\u606f\u4f20\u8f93\u548c\u96c6\u6210\u6a21\u5f0f\u63d0\u4f9b\u7a0b\u5e8f\u3002\r\n\r\nApache ActiveMQ 5.0.0 - 5.13.1\u5728Web\u7ba1\u7406\u63a7\u5236\u53f0\u4e2d\u53caJava\u5185\u5b58\u8f6c\u50a8\u4e2d\u5b58\u5728\u591a\u4e2a\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\uff0c\u7531\u4e8e\u7528\u6237\u6570\u636e\u8f93\u51fa\u9a8c\u8bc1\u9519\u8bef\uff0cJolokia\u5185\u6743\u9650\u8bbe\u7f6e\u4e0d\u5f53\u3002\u5141\u8bb8\u653b\u51fb\u8005\u5229\u7528\u6b64\u6f0f\u6d1e\u8fdb\u884c\u8de8\u7ad9\u811a\u672c\u653b\u51fb\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Apache ActiveMQ Web Console\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "Apache ActiveMQ 5.0.0 - 5.13.1"
  },
  "referenceLink": "http://activemq.apache.org/security-advisories.data/CVE-2016-0782-announcement.txt",
  "serverity": "\u4e2d",
  "submitTime": "2016-03-15",
  "title": "Apache ActiveMQ Web Console\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e"
}

gsd-2016-0782

Vulnerability from gsd

Modified

2023-12-13 01:21

Details

Aliases

CVE-2016-0782

Aliases

CVE-2016-0782

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2016-0782",
    "description": "The administration web console in Apache ActiveMQ 5.x before 5.11.4, 5.12.x before 5.12.3, and 5.13.x before 5.13.2 allows remote authenticated users to conduct cross-site scripting (XSS) attacks and consequently obtain sensitive information from a Java memory dump via vectors related to creating a queue.",
    "id": "GSD-2016-0782",
    "references": [
      "https://access.redhat.com/errata/RHSA-2016:1424"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2016-0782"
      ],
      "details": "The administration web console in Apache ActiveMQ 5.x before 5.11.4, 5.12.x before 5.12.3, and 5.13.x before 5.13.2 allows remote authenticated users to conduct cross-site scripting (XSS) attacks and consequently obtain sensitive information from a Java memory dump via vectors related to creating a queue.",
      "id": "GSD-2016-0782",
      "modified": "2023-12-13T01:21:17.444780Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "secalert@redhat.com",
        "ID": "CVE-2016-0782",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "The administration web console in Apache ActiveMQ 5.x before 5.11.4, 5.12.x before 5.12.3, and 5.13.x before 5.13.2 allows remote authenticated users to conduct cross-site scripting (XSS) attacks and consequently obtain sensitive information from a Java memory dump via vectors related to creating a queue."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "RHSA-2016:1424",
            "refsource": "REDHAT",
            "url": "https://access.redhat.com/errata/RHSA-2016:1424"
          },
          {
            "name": "http://packetstormsecurity.com/files/136215/Apache-ActiveMQ-5.13.0-Cross-Site-Scripting.html",
            "refsource": "MISC",
            "url": "http://packetstormsecurity.com/files/136215/Apache-ActiveMQ-5.13.0-Cross-Site-Scripting.html"
          },
          {
            "name": "http://activemq.apache.org/security-advisories.data/CVE-2016-0782-announcement.txt",
            "refsource": "CONFIRM",
            "url": "http://activemq.apache.org/security-advisories.data/CVE-2016-0782-announcement.txt"
          },
          {
            "name": "1035328",
            "refsource": "SECTRACK",
            "url": "http://www.securitytracker.com/id/1035328"
          },
          {
            "name": "20160310 [ANNOUNCE] CVE-2016-0782: ActiveMQ Web Console - Cross-Site Scripting",
            "refsource": "BUGTRAQ",
            "url": "http://www.securityfocus.com/archive/1/537760/100/0/threaded"
          },
          {
            "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1317516",
            "refsource": "CONFIRM",
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1317516"
          },
          {
            "name": "[activemq-commits] 20190327 svn commit: r1042639 - in /websites/production/activemq/content/activemq-website: ./ projects/artemis/download/ projects/classic/download/ projects/cms/download/ security-advisories.data/",
            "refsource": "MLIST",
            "url": "https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2@%3Ccommits.activemq.apache.org%3E"
          }
        ]
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "[5.0.0,5.11.3],[5.12.0,5.12.2],[5.13.0,5.13.1]",
          "affected_versions": "All versions starting from 5.0.0 up to 5.11.3, all versions starting from 5.12.0 up to 5.12.2, all versions starting from 5.13.0 up to 5.13.1",
          "cvss_v2": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
          "cvss_v3": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-79",
            "CWE-79",
            "CWE-937"
          ],
          "date": "2022-07-06",
          "description": "The administration web console in Apache ActiveMQ 5.x before 5.11.4, 5.12.x before 5.12.3, and 5.13.x before 5.13.2 allows remote authenticated users to conduct cross-site scripting (XSS) attacks and consequently obtain sensitive information from a Java memory dump via vectors related to creating a queue.",
          "fixed_versions": [
            "5.11.4",
            "5.12.3",
            "5.13.2"
          ],
          "identifier": "CVE-2016-0782",
          "identifiers": [
            "GHSA-8rcq-p4gh-vmj8",
            "CVE-2016-0782"
          ],
          "not_impacted": "All versions before 5.0.0, all versions after 5.11.3 before 5.12.0, all versions after 5.12.2 before 5.13.0, all versions after 5.13.1",
          "package_slug": "maven/org.apache.activemq/activemq-client",
          "pubdate": "2022-05-14",
          "solution": "Upgrade to versions 5.11.4, 5.12.3, 5.13.2 or above.",
          "title": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2016-0782",
            "https://access.redhat.com/errata/RHSA-2016:1424",
            "https://bugzilla.redhat.com/show_bug.cgi?id=1317516",
            "https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2@%3Ccommits.activemq.apache.org%3E",
            "http://activemq.apache.org/security-advisories.data/CVE-2016-0782-announcement.txt",
            "http://packetstormsecurity.com/files/136215/Apache-ActiveMQ-5.13.0-Cross-Site-Scripting.html",
            "https://github.com/advisories/GHSA-8rcq-p4gh-vmj8"
          ],
          "uuid": "efbc651f-d174-46b6-b398-dd3ec212c117"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:apache:activemq:5.13.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:activemq:5.12.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:activemq:5.1.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:activemq:5.10.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:activemq:5.11.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:activemq:5.11.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:activemq:5.11.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:activemq:5.13.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:activemq:5.12.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:activemq:5.6.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:activemq:5.10.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:activemq:5.3.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:activemq:5.5.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:activemq:5.9.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:activemq:5.12.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:activemq:5.8.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:activemq:5.7.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:activemq:5.3.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:activemq:5.3.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:activemq:5.4.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:activemq:5.4.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:activemq:5.9.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:activemq:5.11.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:activemq:5.10.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:activemq:5.2.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:activemq:5.5.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:activemq:5.4.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:activemq:5.4.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2016-0782"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "The administration web console in Apache ActiveMQ 5.x before 5.11.4, 5.12.x before 5.12.3, and 5.13.x before 5.13.2 allows remote authenticated users to conduct cross-site scripting (XSS) attacks and consequently obtain sensitive information from a Java memory dump via vectors related to creating a queue."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-79"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://activemq.apache.org/security-advisories.data/CVE-2016-0782-announcement.txt",
              "refsource": "CONFIRM",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "http://activemq.apache.org/security-advisories.data/CVE-2016-0782-announcement.txt"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1317516",
              "refsource": "CONFIRM",
              "tags": [
                "Issue Tracking",
                "Third Party Advisory"
              ],
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1317516"
            },
            {
              "name": "http://packetstormsecurity.com/files/136215/Apache-ActiveMQ-5.13.0-Cross-Site-Scripting.html",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory",
                "VDB Entry"
              ],
              "url": "http://packetstormsecurity.com/files/136215/Apache-ActiveMQ-5.13.0-Cross-Site-Scripting.html"
            },
            {
              "name": "RHSA-2016:1424",
              "refsource": "REDHAT",
              "tags": [],
              "url": "https://access.redhat.com/errata/RHSA-2016:1424"
            },
            {
              "name": "1035328",
              "refsource": "SECTRACK",
              "tags": [],
              "url": "http://www.securitytracker.com/id/1035328"
            },
            {
              "name": "20160310 [ANNOUNCE] CVE-2016-0782: ActiveMQ Web Console - Cross-Site Scripting",
              "refsource": "BUGTRAQ",
              "tags": [],
              "url": "http://www.securityfocus.com/archive/1/537760/100/0/threaded"
            },
            {
              "name": "[activemq-commits] 20190327 svn commit: r1042639 - in /websites/production/activemq/content/activemq-website: ./ projects/artemis/download/ projects/classic/download/ projects/cms/download/ security-advisories.data/",
              "refsource": "MLIST",
              "tags": [],
              "url": "https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2@%3Ccommits.activemq.apache.org%3E"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "cvssV2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "NONE",
            "baseScore": 3.5,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
            "version": "2.0"
          },
          "exploitabilityScore": 6.8,
          "impactScore": 2.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "LOW",
          "userInteractionRequired": true
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.0"
          },
          "exploitabilityScore": 2.3,
          "impactScore": 2.7
        }
      },
      "lastModifiedDate": "2019-03-27T20:29Z",
      "publishedDate": "2016-08-05T15:59Z"
    }
  }
}

fkie_cve-2016-0782

Vulnerability from fkie_nvd

Published

2016-08-05 15:59

Modified

2025-04-12 10:46

Severity ?

5.4 (Medium) - CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Summary

References

URL	Tags
secalert@redhat.com	http://activemq.apache.org/security-advisories.data/CVE-2016-0782-announcement.txt	Vendor Advisory
secalert@redhat.com	http://packetstormsecurity.com/files/136215/Apache-ActiveMQ-5.13.0-Cross-Site-Scripting.html	Third Party Advisory, VDB Entry
secalert@redhat.com	http://www.securityfocus.com/archive/1/537760/100/0/threaded
secalert@redhat.com	http://www.securitytracker.com/id/1035328
secalert@redhat.com	https://access.redhat.com/errata/RHSA-2016:1424
secalert@redhat.com	https://bugzilla.redhat.com/show_bug.cgi?id=1317516	Issue Tracking, Third Party Advisory
secalert@redhat.com	https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108	http://activemq.apache.org/security-advisories.data/CVE-2016-0782-announcement.txt	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	http://packetstormsecurity.com/files/136215/Apache-ActiveMQ-5.13.0-Cross-Site-Scripting.html	Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108	http://www.securityfocus.com/archive/1/537760/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108	http://www.securitytracker.com/id/1035328
af854a3a-2127-422b-91ae-364da2661108	https://access.redhat.com/errata/RHSA-2016:1424
af854a3a-2127-422b-91ae-364da2661108	https://bugzilla.redhat.com/show_bug.cgi?id=1317516	Issue Tracking, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apache.org%3E

Impacted products

Vendor	Product	Version
apache	activemq	5.1.0
apache	activemq	5.2.0
apache	activemq	5.3.0
apache	activemq	5.3.1
apache	activemq	5.3.2
apache	activemq	5.4.0
apache	activemq	5.4.1
apache	activemq	5.4.2
apache	activemq	5.4.3
apache	activemq	5.5.0
apache	activemq	5.5.1
apache	activemq	5.6.0
apache	activemq	5.7.0
apache	activemq	5.8.0
apache	activemq	5.9.0
apache	activemq	5.9.1
apache	activemq	5.10.0
apache	activemq	5.10.1
apache	activemq	5.10.2
apache	activemq	5.11.0
apache	activemq	5.11.1
apache	activemq	5.11.2
apache	activemq	5.11.3
apache	activemq	5.12.0
apache	activemq	5.12.1
apache	activemq	5.12.2
apache	activemq	5.13.0
apache	activemq	5.13.1

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:activemq:5.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "F58D9E69-CBF2-4FB6-B062-ED21F83CBCCB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:activemq:5.2.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "05D6EC30-88DC-4424-BF86-D9C0DA5E191C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:activemq:5.3.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "82ACD6BA-257F-49D0-8944-0991FB038533",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:activemq:5.3.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "C43FD7A1-FC03-47BC-B6C6-02C0F1466762",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:activemq:5.3.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "A7A8D571-2925-4F61-B3F0-8F4A3776F6EA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:activemq:5.4.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "47B31CD9-A3BB-427C-A631-2E8168DD1985",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:activemq:5.4.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "6B904806-6796-4947-BDF4-EEA5681147E8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:activemq:5.4.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "61B4A1EE-7F62-4602-A102-8AD8E9FD528F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:activemq:5.4.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "6075BF1D-AC7C-46E3-A730-4E9A98856520",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:activemq:5.5.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "623530FC-12E9-480B-AFA0-C19FCFFA5D36",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:activemq:5.5.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "C5755A41-0DBE-4F54-A1C1-4F65DCC6ACD2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:activemq:5.6.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "11AADFBF-AC60-4535-892C-BE90BE858172",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:activemq:5.7.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "AC5143E8-B392-4954-9C0D-DD39388B669F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:activemq:5.8.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "F4C0A644-8667-4ABD-8BB3-46289DCD3A93",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:activemq:5.9.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "607B6541-973A-4FF5-8106-A30076CA353C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:activemq:5.9.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "08310F87-4C45-436F-A707-A22A4ACB1587",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:activemq:5.10.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "4243B47C-26B9-45BE-B66A-F1534D18A265",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:activemq:5.10.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "26258CBF-39D0-45FD-AC6B-3D9840CB88EE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:activemq:5.10.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "532FC7B8-31FD-459C-B757-4D17D4E6ED63",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:activemq:5.11.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "36710BEE-E9B8-4979-BB75-6CEF7836268B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:activemq:5.11.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "F15DF0DF-FDBD-4196-88DE-023CF90AA0D0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:activemq:5.11.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "0E1A027B-EDBB-4305-BCE2-5DA862F9A3A3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:activemq:5.11.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "3D70D5C7-8728-49A5-BCCC-62919EE52AC8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:activemq:5.12.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "1DA90EA1-64F2-44DD-86A8-E35191C79446",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:activemq:5.12.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "8E7D827D-8180-4605-98CB-03436F916B27",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:activemq:5.12.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "7D2FC821-2FFF-4710-92CF-FEB74C1A9CE0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:activemq:5.13.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "D00022D7-5D5E-460D-8A82-20E35DB290BC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:activemq:5.13.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "D516F01C-998C-4F06-9B76-09E591923CFE",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The administration web console in Apache ActiveMQ 5.x before 5.11.4, 5.12.x before 5.12.3, and 5.13.x before 5.13.2 allows remote authenticated users to conduct cross-site scripting (XSS) attacks and consequently obtain sensitive information from a Java memory dump via vectors related to creating a queue."
    },
    {
      "lang": "es",
      "value": "La consola de administraci\u00f3n web en Apache ActiveMQ 5.x en versiones anteriores a 5.11.4, 5.12.x en versiones anteriores a 5.12.3 y 5.13.x en versiones anteriores a 5.13.2 permite a usuarios remotos autenticados llevar a cabo ataques XSS y consecuentemente obtener informaci\u00f3n sensible de un volcado de memoria Java a trav\u00e9s de vectores relacionados con la creaci\u00f3n de una cola."
    }
  ],
  "id": "CVE-2016-0782",
  "lastModified": "2025-04-12T10:46:40.837",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "LOW",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "NONE",
          "baseScore": 3.5,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 6.8,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.0"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2016-08-05T15:59:02.473",
  "references": [
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://activemq.apache.org/security-advisories.data/CVE-2016-0782-announcement.txt"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://packetstormsecurity.com/files/136215/Apache-ActiveMQ-5.13.0-Cross-Site-Scripting.html"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.securityfocus.com/archive/1/537760/100/0/threaded"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.securitytracker.com/id/1035328"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://access.redhat.com/errata/RHSA-2016:1424"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1317516"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apache.org%3E"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://activemq.apache.org/security-advisories.data/CVE-2016-0782-announcement.txt"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://packetstormsecurity.com/files/136215/Apache-ActiveMQ-5.13.0-Cross-Site-Scripting.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/537760/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securitytracker.com/id/1035328"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://access.redhat.com/errata/RHSA-2016:1424"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1317516"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apache.org%3E"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

ghsa-8rcq-p4gh-vmj8

Vulnerability from github

Published

2022-05-14 01:14

Modified

2024-03-14 22:38

Severity ?

5.4 (Medium) - CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Summary

Improper Neutralization of Input During Web Page Generation in Apache ActiveMQ

Details

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 5.11.3"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.activemq:activemq-client"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0"
            },
            {
              "fixed": "5.11.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 5.12.2"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.activemq:activemq-client"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.12.0"
            },
            {
              "fixed": "5.12.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 5.13.1"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.activemq:activemq-client"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.13.0"
            },
            {
              "fixed": "5.13.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2016-0782"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-07-06T20:05:48Z",
    "nvd_published_at": "2016-08-05T15:59:00Z",
    "severity": "MODERATE"
  },
  "details": "The administration web console in Apache ActiveMQ 5.x before 5.11.4, 5.12.x before 5.12.3, and 5.13.x before 5.13.2 allows remote authenticated users to conduct cross-site scripting (XSS) attacks and consequently obtain sensitive information from a Java memory dump via vectors related to creating a queue.",
  "id": "GHSA-8rcq-p4gh-vmj8",
  "modified": "2024-03-14T22:38:32Z",
  "published": "2022-05-14T01:14:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0782"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/activemq/commit/0c9fdb5b4180c1ae800bbc8bae7a2c0620f6749b"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/activemq/commit/2061186a0a2486aebf26c4ceb8126933ed01826e"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/activemq/commit/7828069637acb2f1ca1710523f6a2b216c12c7f8"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2016:1424"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1317516"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/activemq/compare/activemq-5.13.1...activemq-5.13.2"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2@%3Ccommits.activemq.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "http://activemq.apache.org/security-advisories.data/CVE-2016-0782-announcement.txt"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/136215/Apache-ActiveMQ-5.13.0-Cross-Site-Scripting.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Improper Neutralization of Input During Web Page Generation in Apache ActiveMQ"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CVE-2016-0782 (GCVE-0-2016-0782)

Vulnerability from cvelistv5

RHSA-2016:1424

Vulnerability from csaf_redhat

rhsa-2016:1424

Vulnerability from csaf_redhat

rhsa-2016_1424

Vulnerability from csaf_redhat

cnvd-2016-01695

Vulnerability from cnvd

gsd-2016-0782

Vulnerability from gsd

fkie_cve-2016-0782

Vulnerability from fkie_nvd

ghsa-8rcq-p4gh-vmj8

Vulnerability from github

Tags

Sightings

Nomenclature