IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2026-06-01 09:16

MODIFIED

2026-06-01 09:16

EPSS (Prob. Exploit)

0.68%

Top 48.2%

DATA SOURCES:

NVD 🔗 2026-06-01 CWE MITRE 🔗 2026-11-01 FIRST EPSS 🔗 2026-10-25 GITHUB 🔗 2026-11-05 OSV 🔗 2026-11-02

> DESCRIPTION

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache ActiveMQ, Apache ActiveMQ Web. The MessageServlet in the ActiveMQ web console API copies every JMS message property into an HTTP response header without any validation. This can allow overwriting and injecting security headers by setting them on JMS messages that are returned by the servlet. This issue affects Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ Web: before 5.19.7, from 6.0.0 before 6.2.6. Users are recommended to upgrade to version 5.19.7 or 6.2.6, which fixes the issue. The MessageServlet has now been deprecated and disabled by default.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> WEAKNESSES

CWE-79

> CWE DETAILED DESCRIPTIONS

CWE-79: Improper Neutralization of Input During Web Page Generation - The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

> GITHUB SECURITY ADVISORY

GHSA-8wm6-6fqh-phmc MODERATE

Apache ActiveMQ, Apache ActiveMQ Web have a Cross-site Scripting issue

AFFECTED PACKAGES:

MAVEN / org.apache.activemq:activemq-web

>= 6.0.0, < 6.2.6

Fixed in: 6.2.6

MAVEN / org.apache.activemq:activemq-web

< 5.19.7

Fixed in: 5.19.7

MAVEN / org.apache.activemq:apache-activemq

>= 6.0.0, < 6.2.6

Fixed in: 6.2.6

MAVEN / org.apache.activemq:apache-activemq

< 5.19.7

Fixed in: 5.19.7

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

Apache ActiveMQ, Apache ActiveMQ Web: HTTP Response Header Injection via JMS Message Properties

AFFECTED PACKAGES:

Unknown / Unknown

24 versions affected

ALIASES:

BIT-activemq-2026-42253, GHSA-8wm6-6fqh-phmc

> HISTORIQUE DES MODIFICATIONS

Première apparition

01/06/2026 09:16

Source: NVD

📊 ENRICHISSEMENT 01/11/2026 06:59

CWE

Champ modifié: Description CWE

Ancienne valeur:

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') - The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in...

Nouvelle valeur:

📊 ENRICHISSEMENT 01/07/2026 06:01

CWE