Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).
CVE-2018-8006
Severity
6.1MEDIUM
EPSS
79.9%
top 0.90%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
Timeline
PublishedOct 10
Latest updateOct 30
Description
An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the queue.jsp page of Apache ActiveMQ versions 5.0.0 to 5.15.5. The root cause of this issue is improper data filtering of the QueueFilter parameter.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7
Affected Packages4 packages
🔴Vulnerability Details
5OSV▶
CVE-2018-8006: An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the queue↗2018-10-10
CVEList▶
CVE-2018-8006: An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the queue↗2018-10-10
VulnCheck▶
Apache ActiveMQ Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')↗2018
💥Exploits & PoCs
1Nuclei▶
Apache ActiveMQ <=5.15.5 - Cross-Site Scripting