Cross-site Scripting in Apache ActiveMQ

MEDIUM 4.3CVE-2012-6092 · GHSA-rp9p-863f-9c4h · Published 21/04/2013 · updated 16/06/2026

In short

CVE-2012-6092 is a MEDIUM (CVSS 4.3) vulnerability affecting org.apache.activemq:activemq-core, activemq (apache).
Chance of exploitation in the next 30 days (EPSS): 6.9%, higher than 94.1% of all vulnerabilities.
Fix: update to 5.8.0 or later.

Package	Affected versions	Patched versions
org.apache.activemq:activemq-core Maven	`< 5.8.0`	`5.8.0`
activemq apache	`= 4.0= 4.0.1= 4.0.2= 4.1.0= 4.1.1= 5.0.0= 5.1.0= 5.2.0= 5.3.0= 5.3.1= 5.3.2= 5.4.0= 5.4.1= 5.4.2= 5.5.0= 5.5.1= 5.6.0≤ 5.7.0`	No fix yet

Description

Multiple cross-site scripting (XSS) vulnerabilities in the web demos in Apache ActiveMQ before 5.8.0 allow remote attackers to inject arbitrary web script or HTML via (1) the refresh parameter to PortfolioPublishServlet.java (aka demo/portfolioPublish or Market Data Publisher), or vectors involving (2) debug logs or (3) subscribe messages in webapp/websocket/chat.js. NOTE: AMQ-4124 is covered by CVE-2012-6551.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2012-6092 · ADVISORY
apache/activemq commit 51eb87a · WEB
fisheye6.atlassian.com/changelog/activemq · WEB
apache/activemq · PACKAGE
issues.apache.org/jira/browse/AMQ-4115 · WEB
issues.apache.org/jira/secure/ReleaseNote.jspa · WEB
activemq.apache.org/activemq-580-release.html · WEB
rhn.redhat.com/errata/RHSA-2013-1029.html · WEB
securityfocus.com/bid/59400 · WEB

More vulnerabilities in org.apache.activemq:activemq-core

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.apache.activemq:activemq-core

Maven

< 5.8.0

5.8.0

activemq

apache

= 4.0= 4.0.1= 4.0.2= 4.1.0= 4.1.1= 5.0.0= 5.1.0= 5.2.0= 5.3.0= 5.3.1= 5.3.2= 5.4.0= 5.4.1= 5.4.2= 5.5.0= 5.5.1= 5.6.0≤ 5.7.0

No fix yet

Description

NVD description

More vulnerabilities in org.apache.activemq:activemq-core

See all →