GHSA-w525-w93j-rxgm

Suggest an improvement
Source
https://github.com/advisories/GHSA-w525-w93j-rxgm
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-w525-w93j-rxgm/GHSA-w525-w93j-rxgm.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-w525-w93j-rxgm
Aliases
Published
2022-05-14T01:14:51Z
Modified
2024-03-14T22:46:39Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
Improper Neutralization of Input During Web Page Generation in Apache ActiveMQ
Details

The web-based administration console in Apache ActiveMQ 5.x before 5.13.2 does not send an X-Frame-Options HTTP header, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web page that contains a (1) FRAME or (2) IFRAME element.

Database specific 
{
    "cwe_ids":  [
        "CWE-79"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2022-07-06T20:07:08Z",
    "nvd_published_at":  "2016-04-07T19:59:00Z",
    "severity":  "MODERATE"
}
References

Affected packages

Maven / org.apache.activemq:activemq-client

Package

Name
org.apache.activemq:activemq-client
View open source insights on deps.dev
Purl
pkg:maven/org.apache.activemq/activemq-client

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.0.0
Fixed
5.13.2

Affected versions

5.*
5.8.0
5.9.0
5.9.1
5.10.0
5.10.1
5.10.2
5.11.0
5.11.1
5.11.2
5.11.3
5.11.4
5.12.0
5.12.1
5.12.2
5.12.3
5.13.0
5.13.1

Database specific

last_known_affected_version_range 
"<= 5.13.1"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-w525-w93j-rxgm/GHSA-w525-w93j-rxgm.json"