Cross-site scripting in Apache ActiveMQ
Priority MEDIUM 60CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Partial Red Hat: 5 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.
Summary
An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the queue.jsp page of Apache ActiveMQ versions 5.0.0 to 5.15.5. The root cause of this issue is improper data filtering of the QueueFilter parameter.
Why it matters now
EPSS 0.55695 99th percentileScored 2026-11-07
Fix Partial org.apache.activemq:activemq-web-console (Maven): 5.15.6Red Hat: 5 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache ActiveMQ | 5.0.0 to 5.15.5 | — | No fix listed | CNA |
| — | org.apache.activemq:activemq-web-console (Maven) | 5.0.0 to before 5.15.6 | 5.15.6 | Patch available | GHSA-hvwm-2624-rp9x |
- Apache ActiveMQ VendorApache Affected 5.0.0 to 5.15.5 Fixed in — No fix listed CNA
- org.apache.activemq:activemq-web-console (Maven) Vendor— Affected 5.0.0 to before 5.15.6 Fixed in 5.15.6 Patch available GHSA-hvwm-2624-rp9x
Remediation
- Fix · GHSA-hvwm-2624-rp9x org.apache.activemq:activemq-web-console (Maven) Fixed in 5.15.6 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| JBoss Developer Studio 11 | Affected | No fix planned: Out of support scope |
| Red Hat Fuse 7 | Affected | No fix planned: Will not fix |
| Red Hat JBoss A-MQ 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix planned: Out of support scope |
Not affected: 6 products
- Red Hat Decision Manager 7
- Red Hat JBoss Data Grid 7
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat Process Automation 7
- Red Hat Single Sign-On 7
- Red Hat Virtualization 4
Timeline
- 2026-10-02 Threatist record created from CVE-2018-8006
- 2026-10-03 Alias added: GHSA-hvwm-2624-rp9x
References
Advisory 2
Other 21
- [activemq-commits] 20190327 [CONF] Apache ActiveMQ > Security Advisories
- [activemq-dev] 20190327 Re: Website
- [activemq-commits] 20190327 svn commit: r1042639 - in /websites/production/activemq/content/activemq-website: ./ projects/artemis/download/ projects/classic/download/ projects/cms/download/ security-advisories.data/
- [activemq-dev] 20190328 Re: Website
- [activemq-gitbox] 20191021 [GitHub] [activemq-website] clebertsuconic commented on a change in pull request #17: Fix the ordering in the security advisories page
- [activemq-gitbox] 20191022 [GitHub] [activemq-website] coheigea commented on a change in pull request #17: Fix the ordering in the security advisories page
- [activemq-commits] 20200514 [activemq-website] branch master updated: Publish CVE-2020-1941 security advisory
- [activemq-commits] 20210208 [activemq-website] branch master updated: Publish CVE-2020-13947
- https://github.com/apache/activemq/commit/2373aa1
- https://github.com/apache/activemq/commit/d8c80a98212ee5d73a281483a2f8b3f517465f62
- https://github.com/apache/activemq
- https://issues.apache.org/jira/browse/AMQ-6954
- https://lists.apache.org/thread.html/03f91b1fb85686a848cee6b90112cf6059bd1b21b23bacaa11a962e1@%3Cdev.activemq.apache.org%3E
- https://lists.apache.org/thread.html/2b5c0039197a4949f29e1e2c9441ab38d242946b966f61c110808bcc@%3Ccommits.activemq.apache.org%3E
- https://lists.apache.org/thread.html/3f1e41bc9153936e065ca3094bd89ff8167ad2d39ac0b410f24382d2@%3Cgitbox.activemq.apache.org%3E
- https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2@%3Ccommits.activemq.apache.org%3E
- https://lists.apache.org/thread.html/c0ec53b72b3240b187afb1cf67e4309a9e5f607282010aa196734814@%3Cgitbox.activemq.apache.org%3E
- https://lists.apache.org/thread.html/fcbe6ad00f1de142148c20d813fae3765dc4274955e3e2f3ca19ff7b@%3Cdev.activemq.apache.org%3E
- https://lists.apache.org/thread.html/r946488fb942fd35c6a6e0359f52504a558ed438574a8f14d36d7dcd7@%3Ccommits.activemq.apache.org%3E
- https://lists.apache.org/thread.html/rb698ed085f79e56146ca24ab359c9ef95846618675ea1ef402e04a6d@%3Ccommits.activemq.apache.org%3E
- https://web.archive.org/web/20200227115717/http://www.securityfocus.com/bid/105156
More Apache Activemq vulnerabilities
- TI-2023-25106 Deserialization of untrusted data in Apache ActiveMQ KEVCVSS 3.1CRITICAL 10.0
- TI-2016-02587 The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote… KEVCVSS 3.1CRITICAL 9.8
- TI-2026-26494 Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans KEVCVSS 3.1HIGH 8.8
- TI-2013-05951 Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not… CVSS 3.1CRITICAL 9.8
- TI-2021-04451 XStream is vulnerable to an Arbitrary Code Execution attack CVSS 3.1CRITICAL 9.1
- TI-2021-04446 XStream is vulnerable to an Arbitrary Code Execution attack CVSS 3.1CRITICAL 9.8
Sources
- CVE-2018-8006 · CVE Program
- CVE-2018-8006 · NVD
- FIRST EPSS
- GHSA-hvwm-2624-rp9x · GitHub Advisory Database · CC BY 4.0
- CVE-2018-8006 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences