CVE-2012-6092

CWE-79 — Cross-site Scripting (XSS)9 documents7 sources
Severity
4.3MEDIUM
EPSS
2.6%
top 14.44%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Apache Activemq
Timeline
PublishedApr 21
Latest updateMay 17

Description

Multiple cross-site scripting (XSS) vulnerabilities in the web demos in Apache ActiveMQ before 5.8.0 allow remote attackers to inject arbitrary web script or HTML via (1) the refresh parameter to PortfolioPublishServlet.java (aka demo/portfolioPublish or Market Data Publisher), or vectors involving (2) debug logs or (3) subscribe messages in webapp/websocket/chat.js. NOTE: AMQ-4124 is covered by CVE-2012-6551.

CVSS vector

AV:N/AC:M/C:N/I:P/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages2 packages

▶NVDapache/activemq5.7.0+17

🔴Vulnerability Details

4
OSV
Cross-site Scripting in Apache ActiveMQ↗2022-05-17
▶
GHSA
Cross-site Scripting in Apache ActiveMQ↗2022-05-17
▶
GHSA
Apache ActiveMQ Cross-site scripting (XSS) vulnerability in the Portfolio publisher servlet↗2022-05-17
▶
CVEList
CVE-2012-6092: Multiple cross-site scripting (XSS) vulnerabilities in the web demos in Apache ActiveMQ before 5↗2013-04-21
▶

📋Vendor Advisories

3
Red Hat
ActiveMQ: XSS vulnerability in portfolioPublish demo application↗2013-03-21
▶
Red Hat
activemq: Multiple XSS flaws in web demos↗2012-10-18
▶
Debian
CVE-2012-6092: activemq - Multiple cross-site scripting (XSS) vulnerabilities in the web demos in Apache A...↗2012
▶

💬Community

1
Bugzilla
CVE-2012-6092 activemq: Multiple XSS flaws in web demos↗2013-04-24
▶
CVE-2012-6092 (MEDIUM CVSS 4.3) | Multiple cross-site scripting (XSS) | cvebase.io