CVE-2012-6092

Description

Multiple cross-site scripting (XSS) vulnerabilities in the web demos in Apache ActiveMQ before 5.8.0 allow remote attackers to inject arbitrary web script or HTML via (1) the refresh parameter to PortfolioPublishServlet.java (aka demo/portfolioPublish or Market Data Publisher), or vectors involving (2) debug logs or (3) subscribe messages in webapp/websocket/chat.js. NOTE: AMQ-4124 is covered by CVE-2012-6551.

Risk Information

Base Score

9.8

MODERATE

Vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score

Exploitation Probability

2.575

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2012-6092 are fixed in Apache-activemq-core 5.8.0	Windows
Multiple Vulnerabilities are affected in IBM Sterling B2B Integrator 5.2	Windows
Multiple Vulnerabilities are affected in IBM Security Verify Directory Integrator 7.2.0	Windows
Vulnerabilities CVE-2012-6092 are fixed in Apache-activemq-core for Linux 5.8.0	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234