{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat JBoss Fuse and A-MQ 6.2.1 Rollup Patch 3, which fixes two security issues and includes several bug fixes and various enhancements, is now available from the Red Hat Customer Portal.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat JBoss Fuse, based on Apache ServiceMix, provides a small-footprint, flexible, open source enterprise service bus and integration platform. Red Hat JBoss A-MQ, based on Apache ActiveMQ, is a standards compliant messaging system that is tailored for use in mission critical applications.\n\nThis patch is an update to Red Hat JBoss Fuse 6.2.1 and Red Hat JBoss A-MQ 6.2.1. It includes several bug fixes, which are documented in the readme.txt file included with the patch files.\n\nSecurity Fix(es):\n\n* It was reported that the web based administration console does not set the X-Frame-Options header in HTTP responses. This allows the console to be embedded in a frame or iframe which could then be used to cause a user to perform an unintended action in the console. (CVE-2016-0734)\n\n* It was found that Apache Active MQ administration web console did not validate input correctly when creating a queue. An authenticated attacker could exploit this flaw via cross-site scripting and use it to access sensitive information or further attacks. (CVE-2016-0782)\n\nRefer to the readme.txt file included with the patch files for installation instructions.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2016:1424",
        "url": "https://access.redhat.com/errata/RHSA-2016:1424"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.fuse\u0026downloadType=securityPatches\u0026version=6.2.1",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.fuse\u0026downloadType=securityPatches\u0026version=6.2.1"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.amq\u0026downloadType=securityPatches\u0026version=6.2.1",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.amq\u0026downloadType=securityPatches\u0026version=6.2.1"
      },
      {
        "category": "external",
        "summary": "1317516",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1317516"
      },
      {
        "category": "external",
        "summary": "1317520",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1317520"
      },
      {
        "category": "external",
        "summary": "ENTMQ-1665",
        "url": "https://issues.redhat.com/browse/ENTMQ-1665"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1424.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat JBoss Fuse/A-MQ 6.2.1 security and bug fix update",
    "tracking": {
      "current_release_date": "2024-11-22T10:13:26+00:00",
      "generator": {
        "date": "2024-11-22T10:13:26+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2016:1424",
      "initial_release_date": "2016-07-13T19:44:16+00:00",
      "revision_history": [
        {
          "date": "2016-07-13T19:44:16+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2019-02-20T12:38:39+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-22T10:13:26+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss A-MQ 6.2",
                "product": {
                  "name": "Red Hat JBoss A-MQ 6.2",
                  "product_id": "Red Hat JBoss A-MQ 6.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_amq:6.2"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat JBoss Fuse 6.2",
                "product": {
                  "name": "Red Hat JBoss Fuse 6.2",
                  "product_id": "Red Hat JBoss Fuse 6.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_fuse:6.2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Fuse"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Naftali Rosenbaum"
          ],
          "organization": "Comsec Consulting"
        }
      ],
      "cve": "CVE-2015-5184",
      "discovery_date": "2015-04-27T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1249183"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that the Hawtio console setting for the Access-Control-Allow-Origin header permits unrestricted sharing (allow all). An attacker could use this flaw to access sensitive information or perform other attacks.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Console: CORS headers set to allow all in Red Hat AMQ",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw affects only the Red Hat AMQ Product, and does not impact Apache ActiveMQ.",
          "title": "Statement"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss A-MQ 6.2",
          "Red Hat JBoss Fuse 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2015-5184"
        },
        {
          "category": "external",
          "summary": "RHBZ#1249183",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1249183"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2015-5184",
          "url": "https://www.cve.org/CVERecord?id=CVE-2015-5184"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-5184",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5184"
        }
      ],
      "release_date": "2015-10-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2016-07-13T19:44:16+00:00",
          "details": "The References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat JBoss A-MQ 6.2",
            "Red Hat JBoss Fuse 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2016:1424"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "Console: CORS headers set to allow all in Red Hat AMQ"
    },
    {
      "cve": "CVE-2016-0734",
      "discovery_date": "2016-03-10T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1317520"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was reported that the web based administration console does not set the X-Frame-Options header in HTTP responses. This allows the console to be embedded in a frame or iframe which could then be used to cause a user to perform an unintended action in the console.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "activemq: Clickjacking in Web Console",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss A-MQ 6.2",
          "Red Hat JBoss Fuse 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2016-0734"
        },
        {
          "category": "external",
          "summary": "RHBZ#1317520",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1317520"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2016-0734",
          "url": "https://www.cve.org/CVERecord?id=CVE-2016-0734"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-0734",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0734"
        },
        {
          "category": "external",
          "summary": "http://activemq.apache.org/security-advisories.data/CVE-2016-0734-announcement.txt",
          "url": "http://activemq.apache.org/security-advisories.data/CVE-2016-0734-announcement.txt"
        }
      ],
      "release_date": "2016-03-10T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2016-07-13T19:44:16+00:00",
          "details": "The References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat JBoss A-MQ 6.2",
            "Red Hat JBoss Fuse 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2016:1424"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "Red Hat JBoss A-MQ 6.2",
            "Red Hat JBoss Fuse 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "activemq: Clickjacking in Web Console"
    },
    {
      "cve": "CVE-2016-0782",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2016-03-10T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1317516"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that Apache Active MQ administration web console did not validate input correctly when creating a queue. An authenticated attacker could exploit this flaw via cross-site scripting and use it to access sensitive information or further attacks.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "activemq: Cross-site scripting vulnerabilities in web console",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss A-MQ 6.2",
          "Red Hat JBoss Fuse 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2016-0782"
        },
        {
          "category": "external",
          "summary": "RHBZ#1317516",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1317516"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2016-0782",
          "url": "https://www.cve.org/CVERecord?id=CVE-2016-0782"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-0782",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0782"
        },
        {
          "category": "external",
          "summary": "http://activemq.apache.org/security-advisories.data/CVE-2016-0782-announcement.txt",
          "url": "http://activemq.apache.org/security-advisories.data/CVE-2016-0782-announcement.txt"
        }
      ],
      "release_date": "2016-03-10T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2016-07-13T19:44:16+00:00",
          "details": "The References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat JBoss A-MQ 6.2",
            "Red Hat JBoss Fuse 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2016:1424"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "NONE",
            "baseScore": 3.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:M/Au:S/C:P/I:N/A:N",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "Red Hat JBoss A-MQ 6.2",
            "Red Hat JBoss Fuse 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "activemq: Cross-site scripting vulnerabilities in web console"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat JBoss Fuse and A-MQ 6.2.1 Rollup Patch 3, which fixes two security issues and includes several bug fixes and various enhancements, is now available from the Red Hat Customer Portal.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat JBoss Fuse, based on Apache ServiceMix, provides a small-footprint, flexible, open source enterprise service bus and integration platform. Red Hat JBoss A-MQ, based on Apache ActiveMQ, is a standards compliant messaging system that is tailored for use in mission critical applications.\n\nThis patch is an update to Red Hat JBoss Fuse 6.2.1 and Red Hat JBoss A-MQ 6.2.1. It includes several bug fixes, which are documented in the readme.txt file included with the patch files.\n\nSecurity Fix(es):\n\n* It was reported that the web based administration console does not set the X-Frame-Options header in HTTP responses. This allows the console to be embedded in a frame or iframe which could then be used to cause a user to perform an unintended action in the console. (CVE-2016-0734)\n\n* It was found that Apache Active MQ administration web console did not validate input correctly when creating a queue. An authenticated attacker could exploit this flaw via cross-site scripting and use it to access sensitive information or further attacks. (CVE-2016-0782)\n\nRefer to the readme.txt file included with the patch files for installation instructions.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2016:1424",
        "url": "https://access.redhat.com/errata/RHSA-2016:1424"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.fuse\u0026downloadType=securityPatches\u0026version=6.2.1",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.fuse\u0026downloadType=securityPatches\u0026version=6.2.1"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.amq\u0026downloadType=securityPatches\u0026version=6.2.1",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.amq\u0026downloadType=securityPatches\u0026version=6.2.1"
      },
      {
        "category": "external",
        "summary": "1317516",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1317516"
      },
      {
        "category": "external",
        "summary": "1317520",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1317520"
      },
      {
        "category": "external",
        "summary": "ENTMQ-1665",
        "url": "https://issues.redhat.com/browse/ENTMQ-1665"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1424.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat JBoss Fuse/A-MQ 6.2.1 security and bug fix update",
    "tracking": {
      "current_release_date": "2024-11-22T10:13:26+00:00",
      "generator": {
        "date": "2024-11-22T10:13:26+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2016:1424",
      "initial_release_date": "2016-07-13T19:44:16+00:00",
      "revision_history": [
        {
          "date": "2016-07-13T19:44:16+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2019-02-20T12:38:39+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-22T10:13:26+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss A-MQ 6.2",
                "product": {
                  "name": "Red Hat JBoss A-MQ 6.2",
                  "product_id": "Red Hat JBoss A-MQ 6.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_amq:6.2"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat JBoss Fuse 6.2",
                "product": {
                  "name": "Red Hat JBoss Fuse 6.2",
                  "product_id": "Red Hat JBoss Fuse 6.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_fuse:6.2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Fuse"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Naftali Rosenbaum"
          ],
          "organization": "Comsec Consulting"
        }
      ],
      "cve": "CVE-2015-5184",
      "discovery_date": "2015-04-27T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1249183"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that the Hawtio console setting for the Access-Control-Allow-Origin header permits unrestricted sharing (allow all). An attacker could use this flaw to access sensitive information or perform other attacks.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Console: CORS headers set to allow all in Red Hat AMQ",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw affects only the Red Hat AMQ Product, and does not impact Apache ActiveMQ.",
          "title": "Statement"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss A-MQ 6.2",
          "Red Hat JBoss Fuse 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2015-5184"
        },
        {
          "category": "external",
          "summary": "RHBZ#1249183",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1249183"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2015-5184",
          "url": "https://www.cve.org/CVERecord?id=CVE-2015-5184"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-5184",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5184"
        }
      ],
      "release_date": "2015-10-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2016-07-13T19:44:16+00:00",
          "details": "The References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat JBoss A-MQ 6.2",
            "Red Hat JBoss Fuse 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2016:1424"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "Console: CORS headers set to allow all in Red Hat AMQ"
    },
    {
      "cve": "CVE-2016-0734",
      "discovery_date": "2016-03-10T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1317520"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was reported that the web based administration console does not set the X-Frame-Options header in HTTP responses. This allows the console to be embedded in a frame or iframe which could then be used to cause a user to perform an unintended action in the console.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "activemq: Clickjacking in Web Console",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss A-MQ 6.2",
          "Red Hat JBoss Fuse 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2016-0734"
        },
        {
          "category": "external",
          "summary": "RHBZ#1317520",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1317520"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2016-0734",
          "url": "https://www.cve.org/CVERecord?id=CVE-2016-0734"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-0734",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0734"
        },
        {
          "category": "external",
          "summary": "http://activemq.apache.org/security-advisories.data/CVE-2016-0734-announcement.txt",
          "url": "http://activemq.apache.org/security-advisories.data/CVE-2016-0734-announcement.txt"
        }
      ],
      "release_date": "2016-03-10T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2016-07-13T19:44:16+00:00",
          "details": "The References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat JBoss A-MQ 6.2",
            "Red Hat JBoss Fuse 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2016:1424"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "Red Hat JBoss A-MQ 6.2",
            "Red Hat JBoss Fuse 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "activemq: Clickjacking in Web Console"
    },
    {
      "cve": "CVE-2016-0782",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2016-03-10T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1317516"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that Apache Active MQ administration web console did not validate input correctly when creating a queue. An authenticated attacker could exploit this flaw via cross-site scripting and use it to access sensitive information or further attacks.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "activemq: Cross-site scripting vulnerabilities in web console",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss A-MQ 6.2",
          "Red Hat JBoss Fuse 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2016-0782"
        },
        {
          "category": "external",
          "summary": "RHBZ#1317516",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1317516"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2016-0782",
          "url": "https://www.cve.org/CVERecord?id=CVE-2016-0782"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-0782",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0782"
        },
        {
          "category": "external",
          "summary": "http://activemq.apache.org/security-advisories.data/CVE-2016-0782-announcement.txt",
          "url": "http://activemq.apache.org/security-advisories.data/CVE-2016-0782-announcement.txt"
        }
      ],
      "release_date": "2016-03-10T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2016-07-13T19:44:16+00:00",
          "details": "The References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat JBoss A-MQ 6.2",
            "Red Hat JBoss Fuse 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2016:1424"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "NONE",
            "baseScore": 3.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:M/Au:S/C:P/I:N/A:N",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "Red Hat JBoss A-MQ 6.2",
            "Red Hat JBoss Fuse 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "activemq: Cross-site scripting vulnerabilities in web console"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat JBoss Fuse and A-MQ 6.2.1 Rollup Patch 3, which fixes two security issues and includes several bug fixes and various enhancements, is now available from the Red Hat Customer Portal.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat JBoss Fuse, based on Apache ServiceMix, provides a small-footprint, flexible, open source enterprise service bus and integration platform. Red Hat JBoss A-MQ, based on Apache ActiveMQ, is a standards compliant messaging system that is tailored for use in mission critical applications.\n\nThis patch is an update to Red Hat JBoss Fuse 6.2.1 and Red Hat JBoss A-MQ 6.2.1. It includes several bug fixes, which are documented in the readme.txt file included with the patch files.\n\nSecurity Fix(es):\n\n* It was reported that the web based administration console does not set the X-Frame-Options header in HTTP responses. This allows the console to be embedded in a frame or iframe which could then be used to cause a user to perform an unintended action in the console. (CVE-2016-0734)\n\n* It was found that Apache Active MQ administration web console did not validate input correctly when creating a queue. An authenticated attacker could exploit this flaw via cross-site scripting and use it to access sensitive information or further attacks. (CVE-2016-0782)\n\nRefer to the readme.txt file included with the patch files for installation instructions.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2016:1424",
        "url": "https://access.redhat.com/errata/RHSA-2016:1424"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.fuse\u0026downloadType=securityPatches\u0026version=6.2.1",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.fuse\u0026downloadType=securityPatches\u0026version=6.2.1"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.amq\u0026downloadType=securityPatches\u0026version=6.2.1",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.amq\u0026downloadType=securityPatches\u0026version=6.2.1"
      },
      {
        "category": "external",
        "summary": "1317516",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1317516"
      },
      {
        "category": "external",
        "summary": "1317520",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1317520"
      },
      {
        "category": "external",
        "summary": "ENTMQ-1665",
        "url": "https://issues.redhat.com/browse/ENTMQ-1665"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1424.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat JBoss Fuse/A-MQ 6.2.1 security and bug fix update",
    "tracking": {
      "current_release_date": "2024-11-22T10:13:26+00:00",
      "generator": {
        "date": "2024-11-22T10:13:26+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2016:1424",
      "initial_release_date": "2016-07-13T19:44:16+00:00",
      "revision_history": [
        {
          "date": "2016-07-13T19:44:16+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2019-02-20T12:38:39+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-22T10:13:26+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss A-MQ 6.2",
                "product": {
                  "name": "Red Hat JBoss A-MQ 6.2",
                  "product_id": "Red Hat JBoss A-MQ 6.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_amq:6.2"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat JBoss Fuse 6.2",
                "product": {
                  "name": "Red Hat JBoss Fuse 6.2",
                  "product_id": "Red Hat JBoss Fuse 6.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_fuse:6.2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Fuse"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Naftali Rosenbaum"
          ],
          "organization": "Comsec Consulting"
        }
      ],
      "cve": "CVE-2015-5184",
      "discovery_date": "2015-04-27T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1249183"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that the Hawtio console setting for the Access-Control-Allow-Origin header permits unrestricted sharing (allow all). An attacker could use this flaw to access sensitive information or perform other attacks.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Console: CORS headers set to allow all in Red Hat AMQ",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw affects only the Red Hat AMQ Product, and does not impact Apache ActiveMQ.",
          "title": "Statement"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss A-MQ 6.2",
          "Red Hat JBoss Fuse 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2015-5184"
        },
        {
          "category": "external",
          "summary": "RHBZ#1249183",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1249183"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2015-5184",
          "url": "https://www.cve.org/CVERecord?id=CVE-2015-5184"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-5184",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5184"
        }
      ],
      "release_date": "2015-10-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2016-07-13T19:44:16+00:00",
          "details": "The References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat JBoss A-MQ 6.2",
            "Red Hat JBoss Fuse 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2016:1424"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "Console: CORS headers set to allow all in Red Hat AMQ"
    },
    {
      "cve": "CVE-2016-0734",
      "discovery_date": "2016-03-10T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1317520"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was reported that the web based administration console does not set the X-Frame-Options header in HTTP responses. This allows the console to be embedded in a frame or iframe which could then be used to cause a user to perform an unintended action in the console.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "activemq: Clickjacking in Web Console",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss A-MQ 6.2",
          "Red Hat JBoss Fuse 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2016-0734"
        },
        {
          "category": "external",
          "summary": "RHBZ#1317520",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1317520"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2016-0734",
          "url": "https://www.cve.org/CVERecord?id=CVE-2016-0734"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-0734",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0734"
        },
        {
          "category": "external",
          "summary": "http://activemq.apache.org/security-advisories.data/CVE-2016-0734-announcement.txt",
          "url": "http://activemq.apache.org/security-advisories.data/CVE-2016-0734-announcement.txt"
        }
      ],
      "release_date": "2016-03-10T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2016-07-13T19:44:16+00:00",
          "details": "The References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat JBoss A-MQ 6.2",
            "Red Hat JBoss Fuse 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2016:1424"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "Red Hat JBoss A-MQ 6.2",
            "Red Hat JBoss Fuse 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "activemq: Clickjacking in Web Console"
    },
    {
      "cve": "CVE-2016-0782",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2016-03-10T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1317516"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that Apache Active MQ administration web console did not validate input correctly when creating a queue. An authenticated attacker could exploit this flaw via cross-site scripting and use it to access sensitive information or further attacks.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "activemq: Cross-site scripting vulnerabilities in web console",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss A-MQ 6.2",
          "Red Hat JBoss Fuse 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2016-0782"
        },
        {
          "category": "external",
          "summary": "RHBZ#1317516",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1317516"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2016-0782",
          "url": "https://www.cve.org/CVERecord?id=CVE-2016-0782"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-0782",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0782"
        },
        {
          "category": "external",
          "summary": "http://activemq.apache.org/security-advisories.data/CVE-2016-0782-announcement.txt",
          "url": "http://activemq.apache.org/security-advisories.data/CVE-2016-0782-announcement.txt"
        }
      ],
      "release_date": "2016-03-10T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2016-07-13T19:44:16+00:00",
          "details": "The References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat JBoss A-MQ 6.2",
            "Red Hat JBoss Fuse 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2016:1424"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "NONE",
            "baseScore": 3.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:M/Au:S/C:P/I:N/A:N",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "Red Hat JBoss A-MQ 6.2",
            "Red Hat JBoss Fuse 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "activemq: Cross-site scripting vulnerabilities in web console"
    }
  ]
}

{
  "GSD": {
    "alias": "CVE-2016-0782",
    "description": "The administration web console in Apache ActiveMQ 5.x before 5.11.4, 5.12.x before 5.12.3, and 5.13.x before 5.13.2 allows remote authenticated users to conduct cross-site scripting (XSS) attacks and consequently obtain sensitive information from a Java memory dump via vectors related to creating a queue.",
    "id": "GSD-2016-0782",
    "references": [
      "https://access.redhat.com/errata/RHSA-2016:1424"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2016-0782"
      ],
      "details": "The administration web console in Apache ActiveMQ 5.x before 5.11.4, 5.12.x before 5.12.3, and 5.13.x before 5.13.2 allows remote authenticated users to conduct cross-site scripting (XSS) attacks and consequently obtain sensitive information from a Java memory dump via vectors related to creating a queue.",
      "id": "GSD-2016-0782",
      "modified": "2023-12-13T01:21:17.444780Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "secalert@redhat.com",
        "ID": "CVE-2016-0782",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "The administration web console in Apache ActiveMQ 5.x before 5.11.4, 5.12.x before 5.12.3, and 5.13.x before 5.13.2 allows remote authenticated users to conduct cross-site scripting (XSS) attacks and consequently obtain sensitive information from a Java memory dump via vectors related to creating a queue."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "RHSA-2016:1424",
            "refsource": "REDHAT",
            "url": "https://access.redhat.com/errata/RHSA-2016:1424"
          },
          {
            "name": "http://packetstormsecurity.com/files/136215/Apache-ActiveMQ-5.13.0-Cross-Site-Scripting.html",
            "refsource": "MISC",
            "url": "http://packetstormsecurity.com/files/136215/Apache-ActiveMQ-5.13.0-Cross-Site-Scripting.html"
          },
          {
            "name": "http://activemq.apache.org/security-advisories.data/CVE-2016-0782-announcement.txt",
            "refsource": "CONFIRM",
            "url": "http://activemq.apache.org/security-advisories.data/CVE-2016-0782-announcement.txt"
          },
          {
            "name": "1035328",
            "refsource": "SECTRACK",
            "url": "http://www.securitytracker.com/id/1035328"
          },
          {
            "name": "20160310 [ANNOUNCE] CVE-2016-0782: ActiveMQ Web Console - Cross-Site Scripting",
            "refsource": "BUGTRAQ",
            "url": "http://www.securityfocus.com/archive/1/537760/100/0/threaded"
          },
          {
            "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1317516",
            "refsource": "CONFIRM",
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1317516"
          },
          {
            "name": "[activemq-commits] 20190327 svn commit: r1042639 - in /websites/production/activemq/content/activemq-website: ./ projects/artemis/download/ projects/classic/download/ projects/cms/download/ security-advisories.data/",
            "refsource": "MLIST",
            "url": "https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2@%3Ccommits.activemq.apache.org%3E"
          }
        ]
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "[5.0.0,5.11.3],[5.12.0,5.12.2],[5.13.0,5.13.1]",
          "affected_versions": "All versions starting from 5.0.0 up to 5.11.3, all versions starting from 5.12.0 up to 5.12.2, all versions starting from 5.13.0 up to 5.13.1",
          "cvss_v2": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
          "cvss_v3": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-79",
            "CWE-79",
            "CWE-937"
          ],
          "date": "2022-07-06",
          "description": "The administration web console in Apache ActiveMQ 5.x before 5.11.4, 5.12.x before 5.12.3, and 5.13.x before 5.13.2 allows remote authenticated users to conduct cross-site scripting (XSS) attacks and consequently obtain sensitive information from a Java memory dump via vectors related to creating a queue.",
          "fixed_versions": [
            "5.11.4",
            "5.12.3",
            "5.13.2"
          ],
          "identifier": "CVE-2016-0782",
          "identifiers": [
            "GHSA-8rcq-p4gh-vmj8",
            "CVE-2016-0782"
          ],
          "not_impacted": "All versions before 5.0.0, all versions after 5.11.3 before 5.12.0, all versions after 5.12.2 before 5.13.0, all versions after 5.13.1",
          "package_slug": "maven/org.apache.activemq/activemq-client",
          "pubdate": "2022-05-14",
          "solution": "Upgrade to versions 5.11.4, 5.12.3, 5.13.2 or above.",
          "title": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2016-0782",
            "https://access.redhat.com/errata/RHSA-2016:1424",
            "https://bugzilla.redhat.com/show_bug.cgi?id=1317516",
            "https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2@%3Ccommits.activemq.apache.org%3E",
            "http://activemq.apache.org/security-advisories.data/CVE-2016-0782-announcement.txt",
            "http://packetstormsecurity.com/files/136215/Apache-ActiveMQ-5.13.0-Cross-Site-Scripting.html",
            "https://github.com/advisories/GHSA-8rcq-p4gh-vmj8"
          ],
          "uuid": "efbc651f-d174-46b6-b398-dd3ec212c117"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:apache:activemq:5.13.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:activemq:5.12.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:activemq:5.1.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:activemq:5.10.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:activemq:5.11.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:activemq:5.11.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:activemq:5.11.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:activemq:5.13.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:activemq:5.12.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:activemq:5.6.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:activemq:5.10.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:activemq:5.3.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:activemq:5.5.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:activemq:5.9.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:activemq:5.12.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:activemq:5.8.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:activemq:5.7.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:activemq:5.3.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:activemq:5.3.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:activemq:5.4.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:activemq:5.4.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:activemq:5.9.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:activemq:5.11.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:activemq:5.10.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:activemq:5.2.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:activemq:5.5.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:activemq:5.4.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:activemq:5.4.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2016-0782"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "The administration web console in Apache ActiveMQ 5.x before 5.11.4, 5.12.x before 5.12.3, and 5.13.x before 5.13.2 allows remote authenticated users to conduct cross-site scripting (XSS) attacks and consequently obtain sensitive information from a Java memory dump via vectors related to creating a queue."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-79"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://activemq.apache.org/security-advisories.data/CVE-2016-0782-announcement.txt",
              "refsource": "CONFIRM",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "http://activemq.apache.org/security-advisories.data/CVE-2016-0782-announcement.txt"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1317516",
              "refsource": "CONFIRM",
              "tags": [
                "Issue Tracking",
                "Third Party Advisory"
              ],
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1317516"
            },
            {
              "name": "http://packetstormsecurity.com/files/136215/Apache-ActiveMQ-5.13.0-Cross-Site-Scripting.html",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory",
                "VDB Entry"
              ],
              "url": "http://packetstormsecurity.com/files/136215/Apache-ActiveMQ-5.13.0-Cross-Site-Scripting.html"
            },
            {
              "name": "RHSA-2016:1424",
              "refsource": "REDHAT",
              "tags": [],
              "url": "https://access.redhat.com/errata/RHSA-2016:1424"
            },
            {
              "name": "1035328",
              "refsource": "SECTRACK",
              "tags": [],
              "url": "http://www.securitytracker.com/id/1035328"
            },
            {
              "name": "20160310 [ANNOUNCE] CVE-2016-0782: ActiveMQ Web Console - Cross-Site Scripting",
              "refsource": "BUGTRAQ",
              "tags": [],
              "url": "http://www.securityfocus.com/archive/1/537760/100/0/threaded"
            },
            {
              "name": "[activemq-commits] 20190327 svn commit: r1042639 - in /websites/production/activemq/content/activemq-website: ./ projects/artemis/download/ projects/classic/download/ projects/cms/download/ security-advisories.data/",
              "refsource": "MLIST",
              "tags": [],
              "url": "https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2@%3Ccommits.activemq.apache.org%3E"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "cvssV2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "NONE",
            "baseScore": 3.5,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
            "version": "2.0"
          },
          "exploitabilityScore": 6.8,
          "impactScore": 2.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "LOW",
          "userInteractionRequired": true
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.0"
          },
          "exploitabilityScore": 2.3,
          "impactScore": 2.7
        }
      },
      "lastModifiedDate": "2019-03-27T20:29Z",
      "publishedDate": "2016-08-05T15:59Z"
    }
  }
}

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:activemq:5.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "F58D9E69-CBF2-4FB6-B062-ED21F83CBCCB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:activemq:5.2.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "05D6EC30-88DC-4424-BF86-D9C0DA5E191C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:activemq:5.3.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "82ACD6BA-257F-49D0-8944-0991FB038533",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:activemq:5.3.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "C43FD7A1-FC03-47BC-B6C6-02C0F1466762",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:activemq:5.3.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "A7A8D571-2925-4F61-B3F0-8F4A3776F6EA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:activemq:5.4.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "47B31CD9-A3BB-427C-A631-2E8168DD1985",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:activemq:5.4.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "6B904806-6796-4947-BDF4-EEA5681147E8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:activemq:5.4.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "61B4A1EE-7F62-4602-A102-8AD8E9FD528F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:activemq:5.4.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "6075BF1D-AC7C-46E3-A730-4E9A98856520",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:activemq:5.5.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "623530FC-12E9-480B-AFA0-C19FCFFA5D36",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:activemq:5.5.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "C5755A41-0DBE-4F54-A1C1-4F65DCC6ACD2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:activemq:5.6.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "11AADFBF-AC60-4535-892C-BE90BE858172",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:activemq:5.7.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "AC5143E8-B392-4954-9C0D-DD39388B669F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:activemq:5.8.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "F4C0A644-8667-4ABD-8BB3-46289DCD3A93",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:activemq:5.9.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "607B6541-973A-4FF5-8106-A30076CA353C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:activemq:5.9.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "08310F87-4C45-436F-A707-A22A4ACB1587",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:activemq:5.10.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "4243B47C-26B9-45BE-B66A-F1534D18A265",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:activemq:5.10.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "26258CBF-39D0-45FD-AC6B-3D9840CB88EE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:activemq:5.10.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "532FC7B8-31FD-459C-B757-4D17D4E6ED63",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:activemq:5.11.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "36710BEE-E9B8-4979-BB75-6CEF7836268B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:activemq:5.11.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "F15DF0DF-FDBD-4196-88DE-023CF90AA0D0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:activemq:5.11.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "0E1A027B-EDBB-4305-BCE2-5DA862F9A3A3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:activemq:5.11.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "3D70D5C7-8728-49A5-BCCC-62919EE52AC8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:activemq:5.12.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "1DA90EA1-64F2-44DD-86A8-E35191C79446",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:activemq:5.12.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "8E7D827D-8180-4605-98CB-03436F916B27",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:activemq:5.12.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "7D2FC821-2FFF-4710-92CF-FEB74C1A9CE0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:activemq:5.13.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "D00022D7-5D5E-460D-8A82-20E35DB290BC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apache:activemq:5.13.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "D516F01C-998C-4F06-9B76-09E591923CFE",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The administration web console in Apache ActiveMQ 5.x before 5.11.4, 5.12.x before 5.12.3, and 5.13.x before 5.13.2 allows remote authenticated users to conduct cross-site scripting (XSS) attacks and consequently obtain sensitive information from a Java memory dump via vectors related to creating a queue."
    },
    {
      "lang": "es",
      "value": "La consola de administraci\u00f3n web en Apache ActiveMQ 5.x en versiones anteriores a 5.11.4, 5.12.x en versiones anteriores a 5.12.3 y 5.13.x en versiones anteriores a 5.13.2 permite a usuarios remotos autenticados llevar a cabo ataques XSS y consecuentemente obtener informaci\u00f3n sensible de un volcado de memoria Java a trav\u00e9s de vectores relacionados con la creaci\u00f3n de una cola."
    }
  ],
  "id": "CVE-2016-0782",
  "lastModified": "2024-11-21T02:42:22.377",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "LOW",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "NONE",
          "baseScore": 3.5,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 6.8,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.0"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2016-08-05T15:59:02.473",
  "references": [
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://activemq.apache.org/security-advisories.data/CVE-2016-0782-announcement.txt"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://packetstormsecurity.com/files/136215/Apache-ActiveMQ-5.13.0-Cross-Site-Scripting.html"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.securityfocus.com/archive/1/537760/100/0/threaded"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.securitytracker.com/id/1035328"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://access.redhat.com/errata/RHSA-2016:1424"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1317516"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apache.org%3E"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://activemq.apache.org/security-advisories.data/CVE-2016-0782-announcement.txt"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://packetstormsecurity.com/files/136215/Apache-ActiveMQ-5.13.0-Cross-Site-Scripting.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/537760/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securitytracker.com/id/1035328"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://access.redhat.com/errata/RHSA-2016:1424"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1317516"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apache.org%3E"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 5.11.3"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.activemq:activemq-client"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0"
            },
            {
              "fixed": "5.11.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 5.12.2"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.activemq:activemq-client"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.12.0"
            },
            {
              "fixed": "5.12.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 5.13.1"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.activemq:activemq-client"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.13.0"
            },
            {
              "fixed": "5.13.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2016-0782"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-07-06T20:05:48Z",
    "nvd_published_at": "2016-08-05T15:59:00Z",
    "severity": "MODERATE"
  },
  "details": "The administration web console in Apache ActiveMQ 5.x before 5.11.4, 5.12.x before 5.12.3, and 5.13.x before 5.13.2 allows remote authenticated users to conduct cross-site scripting (XSS) attacks and consequently obtain sensitive information from a Java memory dump via vectors related to creating a queue.",
  "id": "GHSA-8rcq-p4gh-vmj8",
  "modified": "2024-03-14T22:38:32Z",
  "published": "2022-05-14T01:14:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0782"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/activemq/commit/0c9fdb5b4180c1ae800bbc8bae7a2c0620f6749b"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/activemq/commit/2061186a0a2486aebf26c4ceb8126933ed01826e"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/activemq/commit/7828069637acb2f1ca1710523f6a2b216c12c7f8"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2016:1424"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1317516"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/activemq/compare/activemq-5.13.1...activemq-5.13.2"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2@%3Ccommits.activemq.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "http://activemq.apache.org/security-advisories.data/CVE-2016-0782-announcement.txt"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/136215/Apache-ActiveMQ-5.13.0-Cross-Site-Scripting.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Improper Neutralization of Input During Web Page Generation in Apache ActiveMQ"
}