CVE-2018-8006 Apache ActiveMQ web console vulnerable to Cross-site Scripting

What is CVE-2018-8006?

CVE-2018-8006 is a medium-severity cross-site scripting vulnerability in Apache Activemq, published on 10 Oct 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the queue.jsp page of Apache ActiveMQ versions 5.0.0 to 5.15.5. The root cause of this issue is improper data filtering of the QueueFilter parameter.

Weakness: CWE-79

Which versions are affected by CVE-2018-8006?

2 open source packages ship an affected version, including org.apache.activemq:activemq-web-console. It affects 1 product.

Products include Apache Activemq.

How do I fix CVE-2018-8006?

Upgrade org.apache.activemq:activemq-web-console to 5.15.6 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2018-8006 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2018-8006 exists.

Public exploit code: 1 Nuclei template.

Other vulnerabilities in Apache Activemq

• CVE-2023-46604 Apache ActiveMQ Deserialization of Untrusted Data Exploited Critical 10.0
• CVE-2016-3088 Apache ActiveMQ Improper Input Validation Exploited Critical 9.8
• CVE-2026-34197 Apache ActiveMQ Improper Input Validation Exploited High 8.8
• CVE-2020-11998 Remote code execution in Apache ActiveMQ Critical 9.8
• CVE-2013-7285 Command Injection in Xstream Critical 9.8

All Apache Activemq vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2018-8006, GHSA-hvwm-2624-rp9x, UBUNTU-CVE-2018-8006.