Description

Cross-site scripting (XSS) vulnerability in scheduled.jsp in Apache ActiveMQ 5.8.0 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors involving the "cron of a message."

Mitigation

We recommend upgrading to a version of this component that is not vulnerable to this specific issue. `activemq-core` was moved to `activemq-client` in version 5.8

Related links:

• http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-1879

• https://issues.apache.org/jira/browse/AMQ-4397

• https://exchange.xforce.ibmcloud.com/vulnerabilities/85586