Cross-site scripting in Apache ActiveMQ
Priority LOW 36CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Partial Red Hat: 3 without a fix
Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.
Summary
In Apache ActiveMQ 5.x before 5.14.2, an instance of a cross-site scripting vulnerability was identified to be present in the web based administration console. The root cause of this issue is improper user data output validation.
Why it matters now
EPSS 0.06093 93rd percentileScored 2026-11-07
Fix Partial org.apache.activemq:activemq-client (Maven): 5.14.2Red Hat: 3 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache ActiveMQ | 5.0.0 to 5.14.1 | — | No fix listed | CNA |
| — | org.apache.activemq:activemq-client (Maven) | 5.0.0 to before 5.14.2 | 5.14.2 | Patch available | GHSA-5jg4-p78r-p5j3 |
- Apache ActiveMQ VendorApache Affected 5.0.0 to 5.14.1 Fixed in — No fix listed CNA
- org.apache.activemq:activemq-client (Maven) Vendor— Affected 5.0.0 to before 5.14.2 Fixed in 5.14.2 Patch available GHSA-5jg4-p78r-p5j3
Remediation
- Fix · GHSA-5jg4-p78r-p5j3 org.apache.activemq:activemq-client (Maven) Fixed in 5.14.2 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat JBoss A-MQ 6 | Affected | No fix yet |
| Red Hat JBoss Fuse Service Works 6 | Affected | — |
| Red Hat OpenShift Enterprise 2 | Affected | — |
Not affected: 1 product
- Red Hat JBoss Fuse 6
Timeline
- 2026-10-02 Threatist record created from CVE-2016-6810
- 2026-10-03 Alias added: GHSA-5jg4-p78r-p5j3
References
Advisory 2
Other 9
- [users] 20161209 [ANNOUNCE] CVE-2016-6810: ActiveMQ Web Console - Cross-Site Scripting
- [activemq-commits] 20190327 svn commit: r1042639 - in /websites/production/activemq/content/activemq-website: ./ projects/artemis/download/ projects/classic/download/ projects/cms/download/ security-advisories.data/
- https://github.com/apache/activemq/commit/77b827f
- https://github.com/apache/activemq/commit/c1157fe1f007ee2344a7f0badefa0794c98817cd
- https://github.com/apache/activemq/commit/e16ed24
- https://github.com/apache/activemq
- https://issues.apache.org/jira/browse/AMQ-6468
- https://lists.apache.org/thread.html/924a3a27fad192d711436421e02977ff90d9fc0f298e1efe6757cfbc@%3Cusers.activemq.apache.org%3E
- https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2@%3Ccommits.activemq.apache.org%3E
More Apache Activemq vulnerabilities
- TI-2023-25106 Deserialization of untrusted data in Apache ActiveMQ KEVCVSS 3.1CRITICAL 10.0
- TI-2016-02587 The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote… KEVCVSS 3.1CRITICAL 9.8
- TI-2026-26494 Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans KEVCVSS 3.1HIGH 8.8
- TI-2013-05951 Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not… CVSS 3.1CRITICAL 9.8
- TI-2021-04451 XStream is vulnerable to an Arbitrary Code Execution attack CVSS 3.1CRITICAL 9.1
- TI-2021-04446 XStream is vulnerable to an Arbitrary Code Execution attack CVSS 3.1CRITICAL 9.8
Sources
- CVE-2016-6810 · CVE Program
- CVE-2016-6810 · NVD
- FIRST EPSS
- GHSA-5jg4-p78r-p5j3 · GitHub Advisory Database · CC BY 4.0
- CVE-2016-6810 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences