CVE-2016-0782: apache activemq Cross-site Scripting
CVSS: 5.4v3.0MediumModified
AliasesDEBIAN-CVE-2016-0782GHSA-8rcq-p4gh-vmj8
Published 05-08-2016Last modified 05-08-2024
Vulnerability summary
CVE-2016-0782 is a medium (CVSS 5.4) Cross-site Scripting vulnerability in apache activemq. EPSS estimates a 6.07% chance of exploitation in the next 30 days, higher than 93.3% of scored vulnerabilities.
CVSS score
5.4/10
010
Medium · v3.0 (NVD)EPSS score
6.07%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 05-08-2016PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
The administration web console in Apache ActiveMQ 5.x before 5.11.4, 5.12.x before 5.12.3, and 5.13.x before 5.13.2 allows remote authenticated users to conduct cross-site scripting (XSS) attacks and consequently obtain sensitive information from a Java memory dump via vectors related to creating a queue.
CVSS metrics
4 scores · 3 sources · 2 versionsMedium 5.4Preferred score · NVD (NIST)
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NSourcesAll 3 agree
- OSV · DebianEcosystem advisory · calculated5.4MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- OSV · MavenEcosystem advisory · calculated5.4MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Low 3.5Preferred score · NVD (NIST)
AV:N/AC:M/Au:S/C:N/I:P/A:NSourcesSingle source
EPSS trend
Probability
6.07%
Chance of exploitation in the next 30 days
Percentile
93%
Versus all other CVEs
30-day change
0.00 pp
From 6.07% on 18-09-2026
18-09-202618-10-2026
EPSS score6.07%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Apache1 product
- activemqEOL5.1.0 | 5.2.0 | 5.3.0 | 5.3.1 | 5.3.2 | 5.4.0 | 5.4.1 | 5.4.2 | 5.4.3 | 5.5.0 | 5.5.1 | 5.6.0 | 5.7.0 | 5.8.0 | 5.9.0 | 5.9.1 | 5.10.0 | 5.10.1 | 5.10.2 | 5.11.0 | 5.11.1 | 5.11.2 | 5.11.3 | 5.12.0 | 5.12.1 | 5.12.2 | 5.13.0 | 5.13.1
Debian1 product
- activemq< 5.13.2+dfsg-1
Org.apache.activemq1 product
- activemq-client≥ 5.0.0, < 5.11.4 | ≥ 5.12.0, < 5.12.3 | ≥ 5.13.0, < 5.13.2
3 vendors · 3 products
References
14 links- packetstormsecurity.com/files/136215/Apache-ActiveMQ-5.13.0-Cross-Site-Scripting.htmlX Refsource MISCThird Party AdvisoryVDB EntryWEB
- activemq.apache.org/security-advisories.data/CVE-2016-0782-announcement.txtX Refsource CONFIRMVendor AdvisoryWEB
