{"id":"CVE-2016-0734","published":"2016-04-07T19:00:00Z","modified":"2024-08-05T22:30:03Z","title":"The web-based administration console in Apache ActiveMQ 5.x before 5.13.2 does not send an X-Frame-Options HTTP…","vendor":null,"product":null,"tier":"tail","description":{"text":"The web-based administration console in Apache ActiveMQ 5.x before 5.13.2 does not send an X-Frame-Options HTTP header, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web page that contains a (1) FRAME or (2) IFRAME element.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.08618,"percentile":0.95077,"provenance":"source"},"cwes":[],"references":[{"url":"https://access.redhat.com/errata/RHSA-2016:1424","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www.securitytracker.com/id/1035327","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://www.openwall.com/lists/oss-security/2016/03/10/11","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://activemq.apache.org/security-advisories.data/CVE-2016-0734-announcement.txt","tags":["x_refsource_CONFIRM"]},{"url":"http://www.securityfocus.com/bid/84321","tags":["vdb-entry","x_refsource_BID"]},{"url":"https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]}],"priority":{"score":19.0,"factors":[{"name":"EPSS percentile","points":19.02}]},"affected":[{"ecosystem":"Maven","package":"org.apache.activemq:activemq-client","vulnerableRanges":[">=5.0.0, <5.13.2"],"patched":["5.13.2"],"from":["GHSA-w525-w93j-rxgm"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-5498","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2014-3576","published":"2015-08-14","fixed":"5.11.0","kev":false},{"cve":"CVE-2015-1830","published":"2015-08-19","fixed":"5.11.2","kev":false},{"cve":"CVE-2015-5254","published":"2016-01-08","fixed":"5.12.2","kev":false},{"cve":"CVE-2016-0734","published":"2016-04-07","fixed":"5.13.2","kev":false},{"cve":"CVE-2016-0782","published":"2016-08-05","fixed":"5.13.2","kev":false},{"cve":"CVE-2016-3088","published":"2016-06-01","fixed":"5.14.0","kev":true,"link":{"from":"CVE-2016-0734","to":"CVE-2016-3088","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.activemq:activemq-client","fromFixed":"5.13.2","toFixed":"5.14.0","daysApart":55}]}},{"cve":"CVE-2016-6810","published":"2018-01-10","fixed":"5.14.2","kev":false}],"package":"Maven:org.apache.activemq:activemq-client"}}