CVE-2012-6092
published 2013-04-21CVE-2012-6092: Multiple cross-site scripting (XSS) vulnerabilities in the web demos in Apache ActiveMQ before 5.8.0 allow remote attackers to inject arbitrary web script or…
PriorityP422medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EPSS
6.02%
92.5th percentile
Multiple cross-site scripting (XSS) vulnerabilities in the web demos in Apache ActiveMQ before 5.8.0 allow remote attackers to inject arbitrary web script or HTML via (1) the refresh parameter to PortfolioPublishServlet.java (aka demo/portfolioPublish or Market Data Publisher), or vectors involving (2) debug logs or (3) subscribe messages in webapp/websocket/chat.js. NOTE: AMQ-4124 is covered by CVE-2012-6551.
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | activemq | <= 5.7.0 | — |
| apache | activemq | <= 5.8.0 | — |
| apache | activemq | — | — |
| apache | activemq | — | — |
| apache | activemq | — | — |
| apache | activemq | — | — |
| apache | activemq | — | — |
| apache | activemq | — | — |
| apache | activemq | — | — |
| apache | activemq | — | — |
| apache | activemq | — | — |
| apache | activemq | — | — |
| apache | activemq | — | — |
| apache | activemq | — | — |
| apache | activemq | — | — |
| apache | activemq | — | — |
| apache | activemq | — | — |
| apache | activemq | — | — |
| apache | activemq | — | — |
| apache | activemq | — | — |
| debian | activemq | — | — |
CVSS provenance
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
ghsa5.0MEDIUM
osv5.0MEDIUM
vendor_debian4.3LOW
vendor_redhat4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
ActiveMQ: XSS vulnerability in portfolioPublish demo application
vendor_redhat·2013-03-21·CVSS 4.3
CVE-2013-1880 [MEDIUM] CWE-79 ActiveMQ: XSS vulnerability in portfolioPublish demo application
ActiveMQ: XSS vulnerability in portfolioPublish demo application
Cross-site scripting (XSS) vulnerability in the Portfolio publisher servlet in the demo web application in Apache ActiveMQ before 5.9.0 allows remote attackers to inject arbitrary web script or HTML via the refresh parameter to demo/portfolioPublish, a different vulnerability than CVE-2012-6092.
Package: activemq (OpenShift Enterprise 1) - Not affected
Debian
CVE-2013-1880: activemq - Cross-site scripting (XSS) vulnerability in the Portfolio publisher servlet in t...
vendor_debian·2013·CVSS 4.3
CVE-2013-1880 [MEDIUM] CVE-2013-1880: activemq - Cross-site scripting (XSS) vulnerability in the Portfolio publisher servlet in t...
Cross-site scripting (XSS) vulnerability in the Portfolio publisher servlet in the demo web application in Apache ActiveMQ before 5.9.0 allows remote attackers to inject arbitrary web script or HTML via the refresh parameter to demo/portfolioPublish, a different vulnerability than CVE-2012-6092.
Scope: local
bookworm: resolved
bullseye: resolved
sid: resolved
trixie: resolved
Red Hat
activemq: Multiple XSS flaws in web demos
vendor_redhat·2012-10-18·CVSS 4.3
CVE-2012-6092 [MEDIUM] CWE-79 activemq: Multiple XSS flaws in web demos
activemq: Multiple XSS flaws in web demos
Multiple cross-site scripting (XSS) vulnerabilities in the web demos in Apache ActiveMQ before 5.8.0 allow remote attackers to inject arbitrary web script or HTML via (1) the refresh parameter to PortfolioPublishServlet.java (aka demo/portfolioPublish or Market Data Publisher), or vectors involving (2) debug logs or (3) subscribe messages in webapp/websocket/chat.js. NOTE: AMQ-4124 is covered by CVE-2012-6551.
Package: activemq (OpenShift Enterprise 1) - Not affected
Package: activemq (Red Hat JBoss SOA Platform 4) - Will not fix
Debian
CVE-2012-6092: activemq - Multiple cross-site scripting (XSS) vulnerabilities in the web demos in Apache A...
vendor_debian·2012·CVSS 4.3
CVE-2012-6092 [MEDIUM] CVE-2012-6092: activemq - Multiple cross-site scripting (XSS) vulnerabilities in the web demos in Apache A...
Multiple cross-site scripting (XSS) vulnerabilities in the web demos in Apache ActiveMQ before 5.8.0 allow remote attackers to inject arbitrary web script or HTML via (1) the refresh parameter to PortfolioPublishServlet.java (aka demo/portfolioPublish or Market Data Publisher), or vectors involving (2) debug logs or (3) subscribe messages in webapp/websocket/chat.js. NOTE: AMQ-4124 is covered by CVE-2012-6551.
Scope: local
bookworm: resolved
bullseye: resolved
sid: resolved
trixie: resolved
OSV
Apache ActiveMQ Cross-site scripting (XSS) vulnerability in the Portfolio publisher servlet
osv·2022-05-17·CVSS 4.3
CVE-2013-1880 [MEDIUM] Apache ActiveMQ Cross-site scripting (XSS) vulnerability in the Portfolio publisher servlet
Apache ActiveMQ Cross-site scripting (XSS) vulnerability in the Portfolio publisher servlet
Cross-site scripting (XSS) vulnerability in the Portfolio publisher servlet in the demo web application in Apache ActiveMQ before 5.9.0 allows remote attackers to inject arbitrary web script or HTML via the refresh parameter to demo/portfolioPublish, a different vulnerability than CVE-2012-6092.
OSV
Cross-site Scripting in Apache ActiveMQ
osv·2022-05-17·CVSS 5.0
CVE-2012-6092 [MEDIUM] Cross-site Scripting in Apache ActiveMQ
Cross-site Scripting in Apache ActiveMQ
Multiple cross-site scripting (XSS) vulnerabilities in the web demos in Apache ActiveMQ before 5.8.0 allow remote attackers to inject arbitrary web script or HTML via (1) the refresh parameter to PortfolioPublishServlet.java (aka demo/portfolioPublish or Market Data Publisher), or vectors involving (2) debug logs or (3) subscribe messages in webapp/websocket/chat.js. NOTE: AMQ-4124 is covered by CVE-2012-6551.
GHSA
Apache ActiveMQ Cross-site scripting (XSS) vulnerability in the Portfolio publisher servlet
ghsa·2022-05-17·CVSS 4.3
CVE-2013-1880 [MEDIUM] CWE-79 Apache ActiveMQ Cross-site scripting (XSS) vulnerability in the Portfolio publisher servlet
Apache ActiveMQ Cross-site scripting (XSS) vulnerability in the Portfolio publisher servlet
Cross-site scripting (XSS) vulnerability in the Portfolio publisher servlet in the demo web application in Apache ActiveMQ before 5.9.0 allows remote attackers to inject arbitrary web script or HTML via the refresh parameter to demo/portfolioPublish, a different vulnerability than CVE-2012-6092.
GHSA
Cross-site Scripting in Apache ActiveMQ
ghsa·2022-05-17·CVSS 5.0
CVE-2012-6092 [MEDIUM] CWE-79 Cross-site Scripting in Apache ActiveMQ
Cross-site Scripting in Apache ActiveMQ
Multiple cross-site scripting (XSS) vulnerabilities in the web demos in Apache ActiveMQ before 5.8.0 allow remote attackers to inject arbitrary web script or HTML via (1) the refresh parameter to PortfolioPublishServlet.java (aka demo/portfolioPublish or Market Data Publisher), or vectors involving (2) debug logs or (3) subscribe messages in webapp/websocket/chat.js. NOTE: AMQ-4124 is covered by CVE-2012-6551.
No detection rules found.
No public exploits indexed.
http://activemq.apache.org/activemq-580-release.htmlhttp://rhn.redhat.com/errata/RHSA-2013-1029.htmlhttp://www.securityfocus.com/bid/59400https://fisheye6.atlassian.com/changelog/activemq?cs=1399577https://issues.apache.org/jira/browse/AMQ-4115https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12311210&version=12323282http://activemq.apache.org/activemq-580-release.htmlhttp://rhn.redhat.com/errata/RHSA-2013-1029.htmlhttp://www.securityfocus.com/bid/59400https://fisheye6.atlassian.com/changelog/activemq?cs=1399577https://issues.apache.org/jira/browse/AMQ-4115https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12311210&version=12323282
2013-04-21
Published