Apache ActiveMQ and ActiveMQ Web have a Basic XSS flaw (CWE-79) that allows an attacker who can authenticate to the administrative web console to inject malicious HTML into a JMS selector field. When the attacker forces the web console to deliver a queue browsing page as HTML instead of XML, the injected code is rendered and executed by the victim’s browser. This can lead to session hijacking, credential theft, or other client‑side attacks.

The vulnerability is present in Apache ActiveMQ releases prior to version 5.19.6 and any 6.x releases before 6.2.5, and in Apache ActiveMQ Web with the same version ranges. Upgrades to version 5.19.6 or 6.2.5 and later eliminate the flaw.

The CVSS score of 6.5 indicates a moderate severity. The EPSS score is below 1 percent, suggesting that exploitation likelihood is low, and the vulnerability is not part of the CISA Known Exploited Vulnerabilities catalog. The attack path requires authentication to the web console; once authenticated, the attacker can exploit the flaw via a browser session that loads the manipulated queue page.