WaratekVRT Sign in

Activemq-web CVEs

7 CVEs, 1 exploited, 1 protected by Waratek

Reset
More filters (1)
Columns
Product activemq-web✕
Overview 7 matches · 1 protected · 1 exploited · 0 CISA KEV · 2 public PoC · 2 EPSS ≥ 0.5
7matches 1protected14.3% 1exploited14.3% 0CISA KEV0.0% 2public PoC28.6% 2EPSS ≥ 0.528.6%
Protected by Waratek 1 14.3% Rule in development 0 0.0% Mitigation candidate 2 28.6% No exploit published 4 57.1%
Critical 0 0.0% High 0 0.0% Medium 7 100.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 1 14.3% partly blocked 0 0.0% not blocked 6 85.7% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 14.3% Working exploit published 1 14.3% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 5 71.4%
split by peak 3 / year
No exploit published: 4Mitigation candidate: 2Protected by Waratek: 1 Medium: 7 not blocked: 6blocked by ARMR today: 1 No public exploit: 5Working exploit published: 1Exploited: 1
20101 Mitigation candidate1 Medium1 not blocked1 Working exploit published1 20110 20120 20131 No exploit published1 Medium1 not blocked1 No public exploit1 20140 20150 20160 20170 20181 Mitigation candidate1 Medium1 not blocked1 Exploited1 20190 20201 No exploit published1 Medium1 not blocked1 No public exploit1 20210 20220 20230 20240 20250 20263 Protected by Waratek1 No exploit published2 Medium3 blocked by ARMR today1 not blocked2 No public exploit3
201020122014201620182020202220242026
7 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-52760 Medium 2026-06-30 No exploit published No public exploit Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache ActiveMQ, Apache ActiveMQ Web Console. The browse page in the web console renders a message Id directly without sanitization. This allows an authenticated producer to send a message with a JMS message ID that has been crafted to contain HTML/JavaScript such that when an administrator browses the queue in the Web Console, the payload executes in their browser. This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ Web Console: before 5.19.8, from 6.0.0 before 6.2.7. Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.
CVE-2026-42253 Medium 2026-06-01 No exploit published No public exploit Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache ActiveMQ, Apache ActiveMQ Web. The MessageServlet in the ActiveMQ web console API copies every JMS message property into an HTTP response header without any validation. This can allow overwriting and injecting security headers by setting them on JMS messages that are returned by the servlet. This issue affects Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ Web: before 5.19.7, from 6.0.0 before 6.2.6. Users are recommended to upgrade to version 5.19.7 or 6.2.6, which fixes the issue. The MessageServlet has now been deprecated and disabled by default.
CVE-2026-33227 Medium 2026-04-07 Protected by Waratek No public exploit Improper validation and restriction of a classpath path name vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ. In two instances (when creating a Stomp consumer and also browsing messages in the Web console) an authenticated user provided "key" value could be constructed to traverse the classpath due to path concatenation. As a result, the application is exposed to a classpath path resource loading vulnerability that could potentially be chained together with another attack to lead to exploit. This issue affects Apache ActiveMQ Client: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ Broker: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ All: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ Web: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ: before 5.19.3, from 6.0.0 before 6.2.2. Users are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue. Note: 5.19.3 and 6.2.2 also fix this issue, but that is limited to non-Windows environments due to a path separator resolution bug fixed in 5.19.4 and 6.2.3.
CVE-2020-1941 Medium 2020-05-14 No exploit published No public exploit In Apache ActiveMQ 5.0.0 to 5.15.11, the webconsole admin GUI is open to XSS, in the view that lists the contents of a queue.
CVE-2018-8006 Medium 2018-10-10 Mitigation candidate Exploited An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the queue.jsp page of Apache ActiveMQ versions 5.0.0 to 5.15.5. The root cause of this issue is improper data filtering of the QueueFilter parameter.
CVE-2012-6551 Medium 2013-04-21 No exploit published No public exploit The default configuration of Apache ActiveMQ before 5.8.0 enables a sample web application, which allows remote attackers to cause a denial of service (broker resource consumption) via HTTP requests.
CVE-2010-1587 Medium 2010-04-28 Mitigation candidate Working exploit published The Jetty ResourceHandler in Apache ActiveMQ 5.x before 5.3.2 and 5.4.x before 5.4.0 allows remote attackers to read JSP source code via a // (slash slash) initial substring in a URI for (1) admin/index.jsp, (2) admin/queues.jsp, or (3) admin/topics.jsp.