full-disclosure - DDIVRT-2009-23 Apache ActiveMQ Numerous Cross Site Scripting Issues

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Thu, 16 Apr 2009 10:05:11 -0500
From: "DDI_Vulnerability_Alert" <DDI.VulnerabilityAlert@...frontline.com>
To: <full-disclosure@...ts.grok.org.uk>
Subject: DDIVRT-2009-23 Apache ActiveMQ Numerous Cross
	Site Scripting Issues

Title

-----

DDIVRT-2009-23 Apache ActiveMQ Numerous Cross Site Scripting Issues

Severity

--------

Low

Date Discovered

---------------

February 23rd, 2009

Discovered By

-------------

Digital Defense, Inc. Vulnerability Research Team

Credit: David Marshall and r@...$

Vulnerability Description

-------------------------

ActiveMQ 5.2.0's /admin interface gathers input from the user in
numerous forms which are not properly sanitized.  Attackers may insert
script tags to have them execute when a user browses the affected areas
of the page.

Solution Description

--------------------

User-supplied inputs should not be rendered as executable script code
when presented back to the user.

Tested Systems / Software (with versions)

------------------------------------------

Windows XP SP3, ActiveMQ 5.2.0 Release Windows Binary

Vendor Contact

--------------

Vendor Name: The Apache Software Foundation

Vendor Website: http://activemq.apache.org/

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/