DDIVRT-2009-23 Apache ActiveMQ Numerous Cross Site Scripting Issues

Title

DDIVRT-2009-23 Apache ActiveMQ Numerous Cross Site Scripting Issues

Severity

Low

Date Discovered

February 23rd, 2009

Discovered By

Digital Defense, Inc. Vulnerability Research Team
Credit: David Marshall and r@b13$

Vulnerability Description

ActiveMQ 5.2.0’s /admin interface gathers input from the user in numerous forms which are not properly sanitized.
Attackers may insert script tags to have them execute when a user browses the affected areas of the page.

Solution Description

User-supplied inputs should not be rendered as executable script code when presented back to the user.

Tested Systems / Software (with versions)

Windows XP SP3, ActiveMQ 5.2.0 Release Windows Binary

Vendor Contact

Vendor Name: The Apache Software Foundation
Vendor Website: http://activemq.apache.org/