CVE-2016-0734

MEDIUM

Apache ActiveMQ <5.13.2 - CSRF

Title source: llm

Description

The web-based administration console in Apache ActiveMQ 5.x before 5.13.2 does not send an X-Frame-Options HTTP header, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web page that contains a (1) FRAME or (2) IFRAME element.

References (6)

Scores

CVSS v3 6.1
EPSS 0.0297
EPSS Percentile 86.4%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Classification

CWE
CWE-254
Status draft

Affected Products (28)

apache/activemq
apache/activemq
apache/activemq
apache/activemq
apache/activemq
apache/activemq
apache/activemq
apache/activemq
apache/activemq
apache/activemq
apache/activemq
apache/activemq
apache/activemq
apache/activemq
apache/activemq
... and 13 more

Timeline

Published Apr 07, 2016
Tracked Since Feb 18, 2026