{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2012-10-18T00:00:00", "descriptions": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in the web demos in Apache ActiveMQ before 5.8.0 allow remote attackers to inject arbitrary web script or HTML via (1) the refresh parameter to PortfolioPublishServlet.java (aka demo/portfolioPublish or Market Data Publisher), or vectors involving (2) debug logs or (3) subscribe messages in webapp/websocket/chat.js. NOTE: AMQ-4124 is covered by CVE-2012-6551."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2016-11-25T19:57:01", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat"}, "references": [{"name": "RHSA-2013:1029", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "http://rhn.redhat.com/errata/RHSA-2013-1029.html"}, {"name": "59400", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/59400"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://issues.apache.org/jira/browse/AMQ-4115"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://fisheye6.atlassian.com/changelog/activemq?cs=1399577"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://activemq.apache.org/activemq-580-release.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12311210&version=12323282"}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T21:21:28.460Z"}, "title": "CVE Program Container", "references": [{"name": "RHSA-2013:1029", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "http://rhn.redhat.com/errata/RHSA-2013-1029.html"}, {"name": "59400", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/59400"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://issues.apache.org/jira/browse/AMQ-4115"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://fisheye6.atlassian.com/changelog/activemq?cs=1399577"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://activemq.apache.org/activemq-580-release.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12311210&version=12323282"}]}]}, "cveMetadata": {"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2012-6092", "datePublished": "2013-04-21T21:00:00", "dateReserved": "2012-12-06T00:00:00", "dateUpdated": "2024-08-06T21:21:28.460Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*", "matchCriteriaId": "DA0C6D29-FFCF-4D59-A2D3-2C226F3F679A", "versionEndIncluding": "5.7.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:activemq:4.0:*:*:*:*:*:*:*", "matchCriteriaId": "AA1D17FC-EE96-4E59-A655-541DD4C01822", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:activemq:4.0:m4:*:*:*:*:*:*", "matchCriteriaId": "D5CCD470-62EA-4E53-80BA-D92E74298577", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:activemq:4.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "01145606-6FD6-482F-9F76-4D9C7E452E2F", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:activemq:4.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "B741D677-63F9-4B31-8E68-3084815F9BF6", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:activemq:4.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "BF5D8AFE-B431-482E-892E-C038A96D5FEA", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:activemq:4.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "BCC189C2-95A8-4CA0-8FEF-39857F079425", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:activemq:4.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "1B850F6F-0605-411F-9A98-4B8147DEAD3A", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:activemq:5.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "436F59B9-507A-4B4E-A9F3-022616866151", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:activemq:5.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "F58D9E69-CBF2-4FB6-B062-ED21F83CBCCB", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:activemq:5.2.0:*:*:*:*:*:*:*", "matchCriteriaId": "05D6EC30-88DC-4424-BF86-D9C0DA5E191C", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:activemq:5.3.0:*:*:*:*:*:*:*", "matchCriteriaId": "82ACD6BA-257F-49D0-8944-0991FB038533", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:activemq:5.3.1:*:*:*:*:*:*:*", "matchCriteriaId": "C43FD7A1-FC03-47BC-B6C6-02C0F1466762", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:activemq:5.3.2:*:*:*:*:*:*:*", "matchCriteriaId": "A7A8D571-2925-4F61-B3F0-8F4A3776F6EA", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:activemq:5.4.0:*:*:*:*:*:*:*", "matchCriteriaId": "47B31CD9-A3BB-427C-A631-2E8168DD1985", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:activemq:5.4.1:*:*:*:*:*:*:*", "matchCriteriaId": "6B904806-6796-4947-BDF4-EEA5681147E8", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:activemq:5.4.2:*:*:*:*:*:*:*", "matchCriteriaId": "61B4A1EE-7F62-4602-A102-8AD8E9FD528F", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:activemq:5.5.0:*:*:*:*:*:*:*", "matchCriteriaId": "623530FC-12E9-480B-AFA0-C19FCFFA5D36", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:activemq:5.5.1:*:*:*:*:*:*:*", "matchCriteriaId": "C5755A41-0DBE-4F54-A1C1-4F65DCC6ACD2", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:activemq:5.6.0:*:*:*:*:*:*:*", "matchCriteriaId": "11AADFBF-AC60-4535-892C-BE90BE858172", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in the web demos in Apache ActiveMQ before 5.8.0 allow remote attackers to inject arbitrary web script or HTML via (1) the refresh parameter to PortfolioPublishServlet.java (aka demo/portfolioPublish or Market Data Publisher), or vectors involving (2) debug logs or (3) subscribe messages in webapp/websocket/chat.js. NOTE: AMQ-4124 is covered by CVE-2012-6551."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de ejecuci\u00f3n de comandos en sitios cruzados (XSS) en la web de ejemplo en Apache ActiveMQ anterior a v5.8.0 permite a atacantes remotos inyectar secuencias de comandos web o HTML a trav\u00e9s del par\u00e1metro (1) refresh en PortfolioPublishServlet.java (tambi\u00e9n conocido como demo/portfolioPublish o Market Data Publisher), o vectores relacionados con (2) logs de depuraci\u00f3n, o (3) mensajes de suscripci\u00f3n en webapp/websocket/chat.js. NOTA: AMQ-4124 est\u00e1 cubierto por CVE-2012-6551."}], "id": "CVE-2012-6092", "lastModified": "2023-11-07T02:12:45.537", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}]}, "published": "2013-04-21T21:55:01.083", "references": [{"source": "secalert@redhat.com", "url": "http://activemq.apache.org/activemq-580-release.html"}, {"source": "secalert@redhat.com", "url": "http://rhn.redhat.com/errata/RHSA-2013-1029.html"}, {"source": "secalert@redhat.com", "url": "http://www.securityfocus.com/bid/59400"}, {"source": "secalert@redhat.com", "url": "https://fisheye6.atlassian.com/changelog/activemq?cs=1399577"}, {"source": "secalert@redhat.com", "url": "https://issues.apache.org/jira/browse/AMQ-4115"}, {"source": "secalert@redhat.com", "url": "https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12311210&version=12323282"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2013:1029", "cpe": "cpe:/a:redhat:fuse_mq_enterprise:7.1.0", "product_name": "Fuse MQ Enterprise 7.1.0", "release_date": "2013-07-09T00:00:00Z"}], "bugzilla": {"description": "activemq: Multiple XSS flaws in web demos", "id": "955906", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=955906"}, "csaw": false, "cvss": {"cvss_base_score": "4.3", "cvss_scoring_vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "status": "verified"}, "cwe": "CWE-79", "details": ["Multiple cross-site scripting (XSS) vulnerabilities in the web demos in Apache ActiveMQ before 5.8.0 allow remote attackers to inject arbitrary web script or HTML via (1) the refresh parameter to PortfolioPublishServlet.java (aka demo/portfolioPublish or Market Data Publisher), or vectors involving (2) debug logs or (3) subscribe messages in webapp/websocket/chat.js. NOTE: AMQ-4124 is covered by CVE-2012-6551."], "name": "CVE-2012-6092", "package_state": [{"cpe": "cpe:/a:redhat:openshift:1", "fix_state": "Not affected", "package_name": "activemq", "product_name": "OpenShift Enterprise 1"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:1", "fix_state": "Not affected", "package_name": "amq", "product_name": "Red Hat JBoss Enterprise Web Server 1"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:1", "fix_state": "Not affected", "package_name": "fuse-6.0", "product_name": "Red Hat JBoss Enterprise Web Server 1"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:1", "fix_state": "Affected", "package_name": "fuse-esb-7.1", "product_name": "Red Hat JBoss Enterprise Web Server 1"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:1", "fix_state": "Will not fix", "package_name": "fuse-mb-5.5.1", "product_name": "Red Hat JBoss Enterprise Web Server 1"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:1", "fix_state": "Not affected", "package_name": "fuse-mc-7.1.0", "product_name": "Red Hat JBoss Enterprise Web Server 1"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:1", "fix_state": "Affected", "package_name": "fuse-mq-7.1", "product_name": "Red Hat JBoss Enterprise Web Server 1"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:1", "fix_state": "Will not fix", "package_name": "fuse-others", "product_name": "Red Hat JBoss Enterprise Web Server 1"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:1", "fix_state": "Not affected", "package_name": "others", "product_name": "Red Hat JBoss Enterprise Web Server 1"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_soa_platform:4.3", "fix_state": "Will not fix", "package_name": "activemq", "product_name": "Red Hat JBoss SOA Platform 4.3"}], "public_date": "2012-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2012-6092\nhttps://nvd.nist.gov/vuln/detail/CVE-2012-6092"], "threat_severity": "Moderate"}