CVE-2013-1880 Apache ActiveMQ Cross-site scripting (XSS) vulnerability in the Portfolio publisher servlet
MediumCVSS 4.3
EPSS 6.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting (XSS) vulnerability in the Portfolio publisher servlet in the demo web application in Apache ActiveMQ before 5.9.0 allows remote attackers to inject arbitrary web script or HTML via the refresh parameter to demo/portfolioPublish, a different vulnerability than CVE-2012-6092.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.activemq/activemq-core(Maven) | < 5.9.0 | 5.9.0 |
| org.apache.activemq/activemq-core(Maven) | = 4.1.1 | No fix listed |
| org.apache.activemq/activemq-core(Maven) | = 4.1.2 | No fix listed |
| org.apache.activemq/activemq-core(Maven) | = 5.0.0 | No fix listed |
| org.apache.activemq/activemq-core(Maven) | = 5.1.0 | No fix listed |
| org.apache.activemq/activemq-core(Maven) | = 5.2.0 | No fix listed |
| org.apache.activemq/activemq-core(Maven) | = 5.3.0 | No fix listed |
| org.apache.activemq/activemq-core(Maven) | = 5.3.1 | No fix listed |
| org.apache.activemq/activemq-core(Maven) | = 5.3.2 | No fix listed |
| org.apache.activemq/activemq-core(Maven) | = 5.4.0 | No fix listed |
| org.apache.activemq/activemq-core(Maven) | = 5.4.1 | No fix listed |
| org.apache.activemq/activemq-core(Maven) | = 5.4.2 | No fix listed |
| org.apache.activemq/activemq-core(Maven) | = 5.4.3 | No fix listed |
| org.apache.activemq/activemq-core(Maven) | = 5.5.0 | No fix listed |
| org.apache.activemq/activemq-core(Maven) | = 5.5.1 | No fix listed |
| org.apache.activemq/activemq-core(Maven) | = 5.6.0 | No fix listed |
| org.apache.activemq/activemq-core(Maven) | = 5.7.0 | No fix listed |
| apache activemq | <= 5.8.0 | No fix listed |
| apache activemq | = 5.0.0 | No fix listed |
| apache activemq | = 5.1.0 | No fix listed |
| apache activemq | = 5.2.0 | No fix listed |
| apache activemq | = 5.3.0 | No fix listed |
| apache activemq | = 5.3.1 | No fix listed |
| apache activemq | = 5.3.2 | No fix listed |
| apache activemq | = 5.4.0 | No fix listed |
Show 6 more
| Product | Affected versions | Fixed in |
|---|---|---|
| apache activemq | = 5.4.1 | No fix listed |
| apache activemq | = 5.4.2 | No fix listed |
| apache activemq | = 5.5.0 | No fix listed |
| apache activemq | = 5.5.1 | No fix listed |
| apache activemq | = 5.6.0 | No fix listed |
| apache activemq | = 5.7.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- bugzilla.redhat.com
- issues.apache.org exploit
- RHSA-2013:1029 vendor-advisory
- 65615 vdb-entry
- github.com patch
- github.com
- github.com
- Debian Security Tracker CVE-2013-1880 vendor-advisory