PUBLISHED
2026-04-24 11:16
MODIFIED
2026-04-24 11:16
EPSS (Prob. Exploit)
0.72%
Top 46.7%
> DESCRIPTION
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache ActiveMQ, Apache ActiveMQ Web.
An authenticated attacker can show malicious content when browsing queues in the web console by overriding the content type to be HTML (instead of XML) and by injecting HTML into a JMS selector field.
This issue affects Apache ActiveMQ: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ Web: before 5.19.6, from 6.0.0 before 6.2.5.
Users are recommended to upgrade to version 6.2.5 or 5.19.6, which fixes the issue.
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> CWE DETAILED DESCRIPTIONS
CWE-79: Improper Neutralization of Input During Web Page Generation - The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. | CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes - The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.
> GITHUB SECURITY ADVISORY
GHSA-2jp3-2923-9h52
MODERATE
Apache ActiveMQ Vulnerable to Cross-site Scripting
AFFECTED PACKAGES:
MAVEN / org.apache.activemq:activemq-broker
>= 6.0.0, < 6.2.5
Fixed in: 6.2.5
MAVEN / org.apache.activemq:activemq-all
>= 6.0.0, < 6.2.5
Fixed in: 6.2.5
MAVEN / org.apache.activemq:apache-activemq
>= 6.0.0, < 6.2.5
Fixed in: 6.2.5
MAVEN / org.apache.activemq:activemq-broker
< 5.19.6
Fixed in: 5.19.6
MAVEN / org.apache.activemq:activemq-all
< 5.19.6
Fixed in: 5.19.6
MAVEN / org.apache.activemq:apache-activemq
< 5.19.6
Fixed in: 5.19.6
> HISTORIQUE DES MODIFICATIONS
Première apparition
24/04/2026 11:16
Source: NVD
📊
ENRICHISSEMENT
01/11/2026 06:59
CWE
Champ modifié: Description CWE
Ancienne valeur:
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') - The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in...
Nouvelle valeur:
CWE-79: Improper Neutralization of Input During Web Page Generation - The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a...
📊
ENRICHISSEMENT
01/05/2026 06:01
CWE
Champ modifié: Description CWE
Nouvelle valeur:
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') - The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in...
Total des modifications: 2
Dernière mise à jour: 1 week ago