[Full-disclosure] DDIVRT-2009-23 Apache ActiveMQ Numerous Cross Site Scripting Issues

[DDI_Vulnerability_Alert]

Title

-----

DDIVRT-2009-23 Apache ActiveMQ Numerous Cross Site Scripting Issues

 

Severity

--------

Low

 

Date Discovered

---------------

February 23rd, 2009

 

Discovered By

-------------

Digital Defense, Inc. Vulnerability Research Team

Credit: David Marshall and r at b13$

 

Vulnerability Description

-------------------------

ActiveMQ 5.2.0's /admin interface gathers input from the user in
numerous forms which are not properly sanitized.  Attackers may insert
script tags to have them execute when a user browses the affected areas
of the page.

 

Solution Description

--------------------

User-supplied inputs should not be rendered as executable script code
when presented back to the user.

 

Tested Systems / Software (with versions)

------------------------------------------

Windows XP SP3, ActiveMQ 5.2.0 Release Windows Binary

 

Vendor Contact

--------------

Vendor Name: The Apache Software Foundation

Vendor Website: http://activemq.apache.org/

 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20090416/70e7cd02/attachment.html