Date: 16 Apr 2009 15:00:10 -0000
From: [email protected]
To: [email protected]Subject: DDIVRT-2009-23 Apache ActiveMQ Numerous Cross Site Scripting Issues
X-Virus-Scanned: antivirus-gw at tyumen.ru
Title
DDIVRT-2009-23 Apache ActiveMQ Numerous Cross Site Scripting Issues
Severity
Low
Date Discovered
February 23rd, 2009
Discovered By
Digital Defense, Inc. Vulnerability Research Team
Credit: David Marshall and r@b13$
Vulnerability Description
ActiveMQ 5.2.0▓s /admin interface gathers input from the user in numerous forms which are not properly sanitized. Attackers may insert script tags to have them execute when a user browses the affected areas of the page.
Solution Description
User-supplied inputs should not be rendered as executable script code when presented back to the user.
Tested Systems / Software (with versions)
------------------------------------------
Windows XP SP3, ActiveMQ 5.2.0 Release Windows Binary
Vendor Contact
Vendor Name: The Apache Software Foundation
Vendor Website: http://activemq.apache.org/
