CVE-2022-35278 HTML Injection in ActiveMQ Artemis Web Console

What is CVE-2022-35278?

CVE-2022-35278 is a medium-severity cross-site scripting vulnerability in Netapp Active Iq Unified Manager, published on 23 Aug 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

In Apache ActiveMQ Artemis prior to 2.24.0, an attacker could show malicious content and/or redirect users to a malicious URL in the web console by using HTML in the name of an address or queue.

Weakness: CWE-79, CWE-80

Which versions are affected by CVE-2022-35278?

2 open source packages ship an affected version, including org.apache.activemq:artemis-server. It affects 3 products.

Products include Apache Artemis, Netapp Active Iq Unified Manager, Netapp Oncommand Workflow Automation.

How do I fix CVE-2022-35278?

Upgrade org.apache.activemq:artemis-server to 2.24.0 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2022-35278 being exploited?

There is no known exploitation of CVE-2022-35278 in the wild and no public exploit code.

Other vulnerabilities in Netapp Active Iq Unified Manager

• CVE-2026-57967 Apache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachment Critical 9.8
• CVE-2026-27446 Apache Artemis, Apache ActiveMQ Artemis: Auth bypass for Core downstream federation Critical 9.3
• CVE-2026-49364 Information disclosure in Apache ActiveMQ Artemis Critical 9.1
• CVE-2026-67593 Missing authorization in Apache ActiveMQ Artemis Critical 9.1
• CVE-2023-50780 Apache ActiveMQ Artemis: Authenticated users could perform RCE via Jolokia MBeans High 8.8

All Netapp Active Iq Unified Manager vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-cv6r-h2fm-pvrp, UBUNTU-CVE-2022-35278.