[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Full-disclosure] DDIVRT-2009-23 Apache ActiveMQ Numerous Cross Site Scripting Issues
- To: <full-disclosure@xxxxxxxxxxxxxxxxx>
- Subject: [Full-disclosure] DDIVRT-2009-23 Apache ActiveMQ Numerous Cross Site Scripting Issues
- From: "DDI_Vulnerability_Alert" <DDI.VulnerabilityAlert@xxxxxxxxxxxxxxxx>
- Date: Thu, 16 Apr 2009 10:05:11 -0500
Title
-----
DDIVRT-2009-23 Apache ActiveMQ Numerous Cross Site Scripting Issues
Severity
--------
Low
Date Discovered
---------------
February 23rd, 2009
Discovered By
-------------
Digital Defense, Inc. Vulnerability Research Team
Credit: David Marshall and r@b13$
Vulnerability Description
-------------------------
ActiveMQ 5.2.0's /admin interface gathers input from the user in
numerous forms which are not properly sanitized. Attackers may insert
script tags to have them execute when a user browses the affected areas
of the page.
Solution Description
--------------------
User-supplied inputs should not be rendered as executable script code
when presented back to the user.
Tested Systems / Software (with versions)
------------------------------------------
Windows XP SP3, ActiveMQ 5.2.0 Release Windows Binary
Vendor Contact
--------------
Vendor Name: The Apache Software Foundation
Vendor Website: http://activemq.apache.org/
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/