CVE-2016-0782 (GCVE-0-2016-0782)

Vulnerability from cvelistv5 – Published: 2016-08-05 15:00 – Updated: 2024-08-05 22:30
VLAI?
Summary
The administration web console in Apache ActiveMQ 5.x before 5.11.4, 5.12.x before 5.12.3, and 5.13.x before 5.13.2 allows remote authenticated users to conduct cross-site scripting (XSS) attacks and consequently obtain sensitive information from a Java memory dump via vectors related to creating a queue.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T22:30:04.755Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "RHSA-2016:1424",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2016:1424"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/136215/Apache-ActiveMQ-5.13.0-Cross-Site-Scripting.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://activemq.apache.org/security-advisories.data/CVE-2016-0782-announcement.txt"
          },
          {
            "name": "1035328",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1035328"
          },
          {
            "name": "20160310 [ANNOUNCE] CVE-2016-0782: ActiveMQ Web Console - Cross-Site Scripting",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/537760/100/0/threaded"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1317516"
          },
          {
            "name": "[activemq-commits] 20190327 svn commit: r1042639 - in /websites/production/activemq/content/activemq-website: ./ projects/artemis/download/ projects/classic/download/ projects/cms/download/ security-advisories.data/",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apache.org%3E"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-03-10T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The administration web console in Apache ActiveMQ 5.x before 5.11.4, 5.12.x before 5.12.3, and 5.13.x before 5.13.2 allows remote authenticated users to conduct cross-site scripting (XSS) attacks and consequently obtain sensitive information from a Java memory dump via vectors related to creating a queue."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-03-27T19:06:05",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2016:1424",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2016:1424"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/136215/Apache-ActiveMQ-5.13.0-Cross-Site-Scripting.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://activemq.apache.org/security-advisories.data/CVE-2016-0782-announcement.txt"
        },
        {
          "name": "1035328",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1035328"
        },
        {
          "name": "20160310 [ANNOUNCE] CVE-2016-0782: ActiveMQ Web Console - Cross-Site Scripting",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/537760/100/0/threaded"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1317516"
        },
        {
          "name": "[activemq-commits] 20190327 svn commit: r1042639 - in /websites/production/activemq/content/activemq-website: ./ projects/artemis/download/ projects/classic/download/ projects/cms/download/ security-advisories.data/",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apache.org%3E"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2016-0782",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The administration web console in Apache ActiveMQ 5.x before 5.11.4, 5.12.x before 5.12.3, and 5.13.x before 5.13.2 allows remote authenticated users to conduct cross-site scripting (XSS) attacks and consequently obtain sensitive information from a Java memory dump via vectors related to creating a queue."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "RHSA-2016:1424",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2016:1424"
            },
            {
              "name": "http://packetstormsecurity.com/files/136215/Apache-ActiveMQ-5.13.0-Cross-Site-Scripting.html",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.com/files/136215/Apache-ActiveMQ-5.13.0-Cross-Site-Scripting.html"
            },
            {
              "name": "http://activemq.apache.org/security-advisories.data/CVE-2016-0782-announcement.txt",
              "refsource": "CONFIRM",
              "url": "http://activemq.apache.org/security-advisories.data/CVE-2016-0782-announcement.txt"
            },
            {
              "name": "1035328",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1035328"
            },
            {
              "name": "20160310 [ANNOUNCE] CVE-2016-0782: ActiveMQ Web Console - Cross-Site Scripting",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/537760/100/0/threaded"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1317516",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1317516"
            },
            {
              "name": "[activemq-commits] 20190327 svn commit: r1042639 - in /websites/production/activemq/content/activemq-website: ./ projects/artemis/download/ projects/classic/download/ projects/cms/download/ security-advisories.data/",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2@%3Ccommits.activemq.apache.org%3E"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2016-0782",
    "datePublished": "2016-08-05T15:00:00",
    "dateReserved": "2015-12-16T00:00:00",
    "dateUpdated": "2024-08-05T22:30:04.755Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:activemq:5.1.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F58D9E69-CBF2-4FB6-B062-ED21F83CBCCB\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:activemq:5.2.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"05D6EC30-88DC-4424-BF86-D9C0DA5E191C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:activemq:5.3.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"82ACD6BA-257F-49D0-8944-0991FB038533\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:activemq:5.3.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"C43FD7A1-FC03-47BC-B6C6-02C0F1466762\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:activemq:5.3.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A7A8D571-2925-4F61-B3F0-8F4A3776F6EA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:activemq:5.4.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"47B31CD9-A3BB-427C-A631-2E8168DD1985\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:activemq:5.4.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"6B904806-6796-4947-BDF4-EEA5681147E8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:activemq:5.4.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"61B4A1EE-7F62-4602-A102-8AD8E9FD528F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:activemq:5.4.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"6075BF1D-AC7C-46E3-A730-4E9A98856520\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:activemq:5.5.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"623530FC-12E9-480B-AFA0-C19FCFFA5D36\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:activemq:5.5.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"C5755A41-0DBE-4F54-A1C1-4F65DCC6ACD2\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:activemq:5.6.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"11AADFBF-AC60-4535-892C-BE90BE858172\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:activemq:5.7.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"AC5143E8-B392-4954-9C0D-DD39388B669F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:activemq:5.8.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F4C0A644-8667-4ABD-8BB3-46289DCD3A93\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:activemq:5.9.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"607B6541-973A-4FF5-8106-A30076CA353C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:activemq:5.9.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"08310F87-4C45-436F-A707-A22A4ACB1587\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:activemq:5.10.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"4243B47C-26B9-45BE-B66A-F1534D18A265\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:activemq:5.10.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"26258CBF-39D0-45FD-AC6B-3D9840CB88EE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:activemq:5.10.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"532FC7B8-31FD-459C-B757-4D17D4E6ED63\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:activemq:5.11.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"36710BEE-E9B8-4979-BB75-6CEF7836268B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:activemq:5.11.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F15DF0DF-FDBD-4196-88DE-023CF90AA0D0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:activemq:5.11.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"0E1A027B-EDBB-4305-BCE2-5DA862F9A3A3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:activemq:5.11.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"3D70D5C7-8728-49A5-BCCC-62919EE52AC8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:activemq:5.12.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"1DA90EA1-64F2-44DD-86A8-E35191C79446\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:activemq:5.12.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"8E7D827D-8180-4605-98CB-03436F916B27\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:activemq:5.12.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"7D2FC821-2FFF-4710-92CF-FEB74C1A9CE0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:activemq:5.13.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D00022D7-5D5E-460D-8A82-20E35DB290BC\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:activemq:5.13.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D516F01C-998C-4F06-9B76-09E591923CFE\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"The administration web console in Apache ActiveMQ 5.x before 5.11.4, 5.12.x before 5.12.3, and 5.13.x before 5.13.2 allows remote authenticated users to conduct cross-site scripting (XSS) attacks and consequently obtain sensitive information from a Java memory dump via vectors related to creating a queue.\"}, {\"lang\": \"es\", \"value\": \"La consola de administraci\\u00f3n web en Apache ActiveMQ 5.x en versiones anteriores a 5.11.4, 5.12.x en versiones anteriores a 5.12.3 y 5.13.x en versiones anteriores a 5.13.2 permite a usuarios remotos autenticados llevar a cabo ataques XSS y consecuentemente obtener informaci\\u00f3n sensible de un volcado de memoria Java a trav\\u00e9s de vectores relacionados con la creaci\\u00f3n de una cola.\"}]",
      "id": "CVE-2016-0782",
      "lastModified": "2024-11-21T02:42:22.377",
      "metrics": "{\"cvssMetricV30\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.0\", \"vectorString\": \"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N\", \"baseScore\": 5.4, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.3, \"impactScore\": 2.7}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:M/Au:S/C:N/I:P/A:N\", \"baseScore\": 3.5, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"MEDIUM\", \"authentication\": \"SINGLE\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"NONE\"}, \"baseSeverity\": \"LOW\", \"exploitabilityScore\": 6.8, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": true}]}",
      "published": "2016-08-05T15:59:02.473",
      "references": "[{\"url\": \"http://activemq.apache.org/security-advisories.data/CVE-2016-0782-announcement.txt\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"http://packetstormsecurity.com/files/136215/Apache-ActiveMQ-5.13.0-Cross-Site-Scripting.html\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://www.securityfocus.com/archive/1/537760/100/0/threaded\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"http://www.securitytracker.com/id/1035328\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"https://access.redhat.com/errata/RHSA-2016:1424\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=1317516\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Issue Tracking\", \"Third Party Advisory\"]}, {\"url\": \"https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apache.org%3E\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"http://activemq.apache.org/security-advisories.data/CVE-2016-0782-announcement.txt\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"http://packetstormsecurity.com/files/136215/Apache-ActiveMQ-5.13.0-Cross-Site-Scripting.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://www.securityfocus.com/archive/1/537760/100/0/threaded\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.securitytracker.com/id/1035328\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://access.redhat.com/errata/RHSA-2016:1424\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=1317516\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Issue Tracking\", \"Third Party Advisory\"]}, {\"url\": \"https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "secalert@redhat.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-79\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2016-0782\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2016-08-05T15:59:02.473\",\"lastModified\":\"2025-04-12T10:46:40.837\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The administration web console in Apache ActiveMQ 5.x before 5.11.4, 5.12.x before 5.12.3, and 5.13.x before 5.13.2 allows remote authenticated users to conduct cross-site scripting (XSS) attacks and consequently obtain sensitive information from a Java memory dump via vectors related to creating a queue.\"},{\"lang\":\"es\",\"value\":\"La consola de administraci\u00f3n web en Apache ActiveMQ 5.x en versiones anteriores a 5.11.4, 5.12.x en versiones anteriores a 5.12.3 y 5.13.x en versiones anteriores a 5.13.2 permite a usuarios remotos autenticados llevar a cabo ataques XSS y consecuentemente obtener informaci\u00f3n sensible de un volcado de memoria Java a trav\u00e9s de vectores relacionados con la creaci\u00f3n de una cola.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N\",\"baseScore\":5.4,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.3,\"impactScore\":2.7}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:S/C:N/I:P/A:N\",\"baseScore\":3.5,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"LOW\",\"exploitabilityScore\":6.8,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:activemq:5.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F58D9E69-CBF2-4FB6-B062-ED21F83CBCCB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:activemq:5.2.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"05D6EC30-88DC-4424-BF86-D9C0DA5E191C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:activemq:5.3.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"82ACD6BA-257F-49D0-8944-0991FB038533\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:activemq:5.3.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C43FD7A1-FC03-47BC-B6C6-02C0F1466762\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:activemq:5.3.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A7A8D571-2925-4F61-B3F0-8F4A3776F6EA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:activemq:5.4.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"47B31CD9-A3BB-427C-A631-2E8168DD1985\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:activemq:5.4.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6B904806-6796-4947-BDF4-EEA5681147E8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:activemq:5.4.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"61B4A1EE-7F62-4602-A102-8AD8E9FD528F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:activemq:5.4.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6075BF1D-AC7C-46E3-A730-4E9A98856520\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:activemq:5.5.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"623530FC-12E9-480B-AFA0-C19FCFFA5D36\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:activemq:5.5.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C5755A41-0DBE-4F54-A1C1-4F65DCC6ACD2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:activemq:5.6.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"11AADFBF-AC60-4535-892C-BE90BE858172\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:activemq:5.7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AC5143E8-B392-4954-9C0D-DD39388B669F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:activemq:5.8.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F4C0A644-8667-4ABD-8BB3-46289DCD3A93\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:activemq:5.9.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"607B6541-973A-4FF5-8106-A30076CA353C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:activemq:5.9.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"08310F87-4C45-436F-A707-A22A4ACB1587\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:activemq:5.10.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4243B47C-26B9-45BE-B66A-F1534D18A265\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:activemq:5.10.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"26258CBF-39D0-45FD-AC6B-3D9840CB88EE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:activemq:5.10.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"532FC7B8-31FD-459C-B757-4D17D4E6ED63\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:activemq:5.11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"36710BEE-E9B8-4979-BB75-6CEF7836268B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:activemq:5.11.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F15DF0DF-FDBD-4196-88DE-023CF90AA0D0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:activemq:5.11.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0E1A027B-EDBB-4305-BCE2-5DA862F9A3A3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:activemq:5.11.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3D70D5C7-8728-49A5-BCCC-62919EE52AC8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:activemq:5.12.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1DA90EA1-64F2-44DD-86A8-E35191C79446\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:activemq:5.12.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8E7D827D-8180-4605-98CB-03436F916B27\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:activemq:5.12.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7D2FC821-2FFF-4710-92CF-FEB74C1A9CE0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:activemq:5.13.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D00022D7-5D5E-460D-8A82-20E35DB290BC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:activemq:5.13.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D516F01C-998C-4F06-9B76-09E591923CFE\"}]}]}],\"references\":[{\"url\":\"http://activemq.apache.org/security-advisories.data/CVE-2016-0782-announcement.txt\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://packetstormsecurity.com/files/136215/Apache-ActiveMQ-5.13.0-Cross-Site-Scripting.html\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.securityfocus.com/archive/1/537760/100/0/threaded\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.securitytracker.com/id/1035328\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2016:1424\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=1317516\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Issue Tracking\",\"Third Party Advisory\"]},{\"url\":\"https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apache.org%3E\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://activemq.apache.org/security-advisories.data/CVE-2016-0782-announcement.txt\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://packetstormsecurity.com/files/136215/Apache-ActiveMQ-5.13.0-Cross-Site-Scripting.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.securityfocus.com/archive/1/537760/100/0/threaded\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securitytracker.com/id/1035328\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2016:1424\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=1317516\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Third Party Advisory\"]},{\"url\":\"https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.