{"id":"CVE-2016-0782","published":"2016-08-05T15:00:00Z","modified":"2024-08-05T22:30:04Z","title":"The administration web console in Apache ActiveMQ 5.x before 5.11.4, 5.12.x before 5.12.3, and 5.13.x before 5.13.2…","vendor":null,"product":null,"tier":"tail","description":{"text":"The administration web console in Apache ActiveMQ 5.x before 5.11.4, 5.12.x before 5.12.3, and 5.13.x before 5.13.2 allows remote authenticated users to conduct cross-site scripting (XSS) attacks and consequently obtain sensitive information from a Java memory dump via vectors related to creating a queue.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.06068,"percentile":0.93363,"provenance":"source"},"cwes":[],"references":[{"url":"https://access.redhat.com/errata/RHSA-2016:1424","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://packetstormsecurity.com/files/136215/Apache-ActiveMQ-5.13.0-Cross-Site-Scripting.html","tags":["x_refsource_MISC"]},{"url":"http://activemq.apache.org/security-advisories.data/CVE-2016-0782-announcement.txt","tags":["x_refsource_CONFIRM"]},{"url":"http://www.securitytracker.com/id/1035328","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://www.securityfocus.com/archive/1/537760/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1317516","tags":["x_refsource_CONFIRM"]},{"url":"https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]}],"priority":{"score":23.7,"factors":[{"name":"EPSS percentile","points":18.67},{"name":"Public exploit code","points":5.0}]},"affected":[{"ecosystem":"Maven","package":"org.apache.activemq:activemq-client","vulnerableRanges":[">=5.0.0, <5.11.4",">=5.12.0, <5.12.3",">=5.13.0, <5.13.2"],"patched":["5.11.4","5.12.3","5.13.2"],"from":["GHSA-8rcq-p4gh-vmj8"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-3227","exploited":false,"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/136215/Apache-ActiveMQ-5.13.0-Cross-Site-Scripting.html"],"lineage":{"packageHistory":[{"cve":"CVE-2015-1830","published":"2015-08-19","fixed":"5.11.2","kev":false},{"cve":"CVE-2015-5254","published":"2016-01-08","fixed":"5.12.2","kev":false,"link":{"from":"CVE-2015-5254","to":"CVE-2016-0782","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.activemq:activemq-client","fromFixed":"5.11.3","toFixed":"5.11.4","daysApart":210}]}},{"cve":"CVE-2016-0734","published":"2016-04-07","fixed":"5.13.2","kev":false},{"cve":"CVE-2016-0782","published":"2016-08-05","fixed":"5.13.2","kev":false},{"cve":"CVE-2016-3088","published":"2016-06-01","fixed":"5.14.0","kev":true},{"cve":"CVE-2016-6810","published":"2018-01-10","fixed":"5.14.2","kev":false},{"cve":"CVE-2015-7559","published":"2019-08-01","fixed":"5.14.5","kev":false}],"package":"Maven:org.apache.activemq:activemq-client"}}