What is GHSA-c9gx-27hq-wcvj?

GHSA-c9gx-27hq-wcvj is a security advisory published by GitHub Security Advisories with Medium severity. Apache ActiveMQ Cross-site scripting (XSS) vulnerability in the Portfolio publisher servlet

Which CVE IDs does GHSA-c9gx-27hq-wcvj cover?

GHSA-c9gx-27hq-wcvj covers the following CVE IDs: CVE-2013-1880. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-c9gx-27hq-wcvj?

GHSA-c9gx-27hq-wcvj affects 1 product, including: maven/org.apache.activemq:activemq-core:\u003c 5.9.0.

GHSA-c9gx-27hq-wcvjMedium

Apache ActiveMQ Cross-site scripting (XSS) vulnerability in the Portfolio publisher servlet

Vendor

GitHub Security Advisories

Published

May 17, 2022

Last Modified

December 20, 2023

🔗 CVE IDs covered (1)

CVE-2013-1880 →

📋 Description

Cross-site scripting (XSS) vulnerability in the Portfolio publisher servlet in the demo web application in Apache ActiveMQ before 5.9.0 allows remote attackers to inject arbitrary web script or HTML via the refresh parameter to demo/portfolioPublish, a different vulnerability than CVE-2012-6092.

🎯 Affected products1

maven/org.apache.activemq:activemq-core:< 5.9.0

🔗 References (7)

https://nvd.nist.gov/vuln/detail/CVE-2013-1880
https://bugzilla.redhat.com/show_bug.cgi?id=924447
https://issues.apache.org/jira/browse/AMQ-4398
http://rhn.redhat.com/errata/RHSA-2013-1029.html
http://www.securityfocus.com/bid/65615
https://github.com/apache/activemq/commit/fafd12dfd4f71336f8e32c090d40ed1445959b40
https://github.com/advisories/GHSA-c9gx-27hq-wcvj