CVE-2018-8006

MEDIUMNuclei

Apache ActiveMQ web console vulnerable to Cross-site Scripting

Title source: GitHub Advisory
STIX 2.1 vulnerability

Record summary

CVE-2018-8006 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the queue.jsp page of Apache ActiveMQ versions 5.0.0 to 5.15.5. The root cause of this issue is improper data filtering of the QueueFilter parameter.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Dec 5, 2023 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

Affected products and versions

3
ProductSourceVersion range

ActiveMQ

Browse Apache / ActiveMQ
VulnCheckVersion data not supplied

Apache ActiveMQ

Browse Apache Software Foundation / Apache ActiveMQ
CVE List5.0.0 to 5.15.5affected

org.apache.activemq:activemq-web-console

Browse Maven / org.apache.activemq:activemq-web-console
GitHub Advisory5.0.0 to < 5.15.6 · Fixed in 5.15.6affected

Nuclei templates

1
ProjectDiscoveryMEDIUMApache ActiveMQ <=5.15.5 - Cross-Site ScriptingCVSS 6.1

Apache ActiveMQ versions 5.0.0 to 5.15.5 are vulnerable to cross-site scripting via the web based administration console on the queue.jsp page. The root cause of this issue is improper data filtering of the QueueFilter parameter.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary script code in the context of the victim's browser, potentially leading to session hijacking, defacement, or theft of sensitive information.

Remediation

Upgrade Apache ActiveMQ to a version higher than 5.15.5 or apply the necessary patches provided by the vendor.

WeaknessesCWE-79
Authorspdteam
Template tagscve2018cveapacheactivemqxssvkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*
Shodan: cpe:"cpe:2.3:a:apache:activemq"
Shodan: product:"activemq openwire transport"
http://activemq.apache.org/security-advisories.data/CVE-2018-8006-announcement.txt https://lists.apache.org/thread.html/2b5c0039197a4949f29e1e2c9441ab38d242946b966f61c110808bcc@%3Ccommits.activemq.apache.org%3E https://lists.apache.org/thread.html/fcbe6ad00f1de142148c20d813fae3765dc4274955e3e2f3ca19ff7b@%3Cdev.activemq.apache.org%3E https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2@%3Ccommits.activemq.apache.org%3E https://lists.apache.org/thread.html/03f91b1fb85686a848cee6b90112cf6059bd1b21b23bacaa11a962e1@%3Cdev.activemq.apache.org%3E https://lists.apache.org/thread.html/3f1e41bc9153936e065ca3094bd89ff8167ad2d39ac0b410f24382d2@%3Cgitbox.activemq.apache.org%3E

Source: ProjectDiscovery

References

Showing 12 of 24