CVE-2016-0782

Publicada em 05 ago 2016 · Atualizada em 05 ago 2024

Seguir esta CVE + Monitorar activemq + Monitorar org.apache.activemq:activemq-client

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

3Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackepss 6.1%

The administration web console in Apache ActiveMQ 5.x before 5.11.4, 5.12.x before 5.12.3, and 5.13.x before 5.13.2 allows remote authenticated users to conduct cross-site scripting (XSS) attacks and consequently obtain sensitive information from a Java memory dump via vectors related to creating a queue.

Produtos afetados

n/a · n/a

Referências

http://activemq.apache.org/security-advisories.data/CVE-2016-0782-announcement.txt http://packetstormsecurity.com/files/136215/Apache-ActiveMQ-5.13.0-Cross-Site-Scripting.html https://access.redhat.com/errata/RHSA-2016:1424 https://bugzilla.redhat.com/show_bug.cgi?id=1317516 https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apache.org%3E http://www.securityfocus.com/archive/1/537760/100/0/threaded http://www.securitytracker.com/id/1035328