Non notée
CVE-2026-42253 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache ActiveMQ,…
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache ActiveMQ, Apache ActiveMQ Web. The MessageServlet in the ActiveMQ web console API copies every JMS message property into an HTTP response header without any validation. This can allow overwriting and injecting security headers by setting them on JMS messages that are returned by the servlet. This issue affects Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ Web: before 5.19.7, from 6.0.0 before 6.2.6. Users are recommended to upgrade to version 5.19.7 or 6.2.6, which fixes the issue. The MessageServlet has now been deprecated and disabled by default.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Apache ActiveMQ 6.0 | 6.0.0 → < 6.2.6 | 6.2.6 |
| Apache ActiveMQ 5.19 | premières → < 5.19.7 | 5.19.7 |
| Apache ActiveMQ Web 6.0 | 6.0.0 → < 6.2.6 | 6.2.6 |
| Apache ActiveMQ Web 5.19 | premières → < 5.19.7 | 5.19.7 |
Références
- lists.apache.org lists.apache.org
Chronologie
- Publiée
- Dernière modification
Autres CVE de Apache ActiveMQ
Les 40 CVE de Apache ActiveMQ →
CVE-2026-108500
Apache ActiveMQ: LDAPAuthorizationMap allows authorization bypass via DN injection
Non notée
CVE-2026-108946
Apache ActiveMQ, ActiveMQ Broker: The broker does not verify user provided connection id matches connection
Non notée
CVE-2026-111822
Apache ActiveMQ, Apache ActiveMQ Runtime Config: ActiveMQ retains write access after live ACL revocation
Non notée
CVE-2026-111821
Apache ActiveMQ, Apache ActiveMQ KahaDB: Oversized client identifier strings poison the KahaDB journal
Non notée