==================================================================== CERT-Renater Note d'Information No. 2020/VULN275 _____________________________________________________________________ DATE : 15/05/2020 HARDWARE PLATFORM(S): / OPERATING SYSTEM(S): Systems running Apache ActiveMQ versions prior to 5.15.12. ===================================================================== http://mail-archives.apache.org/mod_mbox/activemq-users/202005.mbox/%3c27606498-99A6-4794-9057-1CCDD10B2591@nanthrax.net%3e _____________________________________________________________________ [CVE-2020-1941] XSS in WebConsole Severity: Medium Vendor: The Apache Software Foundation Versions Affected: Apache ActiveMQ 5.0.0 - 5.15.11 Description: The webconsole admin GUI is open to XSS, in the view that lists the contents of a queue. Mitigation: Upgrade to Apache ActiveMQ 5.15.12. Credit: This issue was discovered by: * Przemysław Kowalski > ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 23/25 Rue Daviel | fax : 01-53-94-20-41 + + 75013 Paris | email:cert@support.renater.fr + =========================================================