Full Disclosure mailing list archives
DDIVRT-2009-23 Apache ActiveMQ Numerous Cross Site Scripting Issues
From: "DDI_Vulnerability_Alert" <DDI.VulnerabilityAlert () ddifrontline com>
Date: Thu, 16 Apr 2009 10:05:11 -0500
Title ----- DDIVRT-2009-23 Apache ActiveMQ Numerous Cross Site Scripting Issues Severity -------- Low Date Discovered --------------- February 23rd, 2009 Discovered By ------------- Digital Defense, Inc. Vulnerability Research Team Credit: David Marshall and r@b13$ Vulnerability Description ------------------------- ActiveMQ 5.2.0's /admin interface gathers input from the user in numerous forms which are not properly sanitized. Attackers may insert script tags to have them execute when a user browses the affected areas of the page. Solution Description -------------------- User-supplied inputs should not be rendered as executable script code when presented back to the user. Tested Systems / Software (with versions) ------------------------------------------ Windows XP SP3, ActiveMQ 5.2.0 Release Windows Binary Vendor Contact -------------- Vendor Name: The Apache Software Foundation Vendor Website: http://activemq.apache.org/
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- DDIVRT-2009-23 Apache ActiveMQ Numerous Cross Site Scripting Issues DDI_Vulnerability_Alert (Apr 16)