Apache ActiveMQ Numerous Cross Site Scripting Issues

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1052033 漏洞类型
发布时间 2009-04-17 更新时间 2009-04-17
CVE编号 N/A CNNVD-ID N/A
漏洞平台 N/A CVSS评分 N/A
|漏洞来源
https://cxsecurity.com/issue/WLB-2009040051
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
 Title
-----
DDIVRT-2009-23 Apache ActiveMQ Numerous Cross Site Scripting Issues

Severity
--------
Low

Date Discovered
---------------
February 23rd, 2009

Discovered By
-------------
Digital Defense, Inc. Vulnerability Research Team
Credit: David Marshall and r_at_b13$

Vulnerability Description
-------------------------
ActiveMQ 5.2.0s /admin interface gathers input from the user in numerous forms which are not properly sanitized.  Attackers may insert script tags to have them execute when a user browses the affected areas of the page.

Solution Description
--------------------
User-supplied inputs should not be rendered as executable script code when presented back to the user.

Tested Systems / Software (with versions)
------------------------------------------
Windows XP SP3, ActiveMQ 5.2.0 Release Windows Binary

Vendor Contact
--------------
Vendor Name: The Apache Software Foundation
Vendor Website: http://activemq.apache.org/