Apache ActiveMQ CVE-2014-8110 Multiple Cross Site Scripting Vulnerabilities

Bugtraq ID:	72511
Class:	Input Validation Error
CVE:	CVE-2014-8110
Remote:	Yes
Local:	No
Published:	Feb 05 2015 12:00AM
Updated:	Feb 02 2016 08:10PM
Credit:	Georgi Geshev from MWR Labs
Vulnerable:	Apache Software Foundation Apache ActiveMQ 5.5 Apache Software Foundation Apache ActiveMQ 5.3 Apache Software Foundation Apache ActiveMQ 5.2 Apache Software Foundation Apache ActiveMQ 5.4
Not Vulnerable:

Apache ActiveMQ CVE-2014-8110 Multiple Cross Site Scripting Vulnerabilities

Apache ActiveMQ is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Apache ActiveMQ 5.0.0 through 5.10.0 are vulnerable.

Apache ActiveMQ CVE-2014-8110 Multiple Cross Site Scripting Vulnerabilities

Attackers can exploit this issue by enticing an unsuspecting victim into following a malicious URI.

Apache ActiveMQ CVE-2014-8110 Multiple Cross Site Scripting Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Apache ActiveMQ CVE-2014-8110 Multiple Cross Site Scripting Vulnerabilities

References:

• Apache ActiveMQ Homepage (Apache Software Foundation)