CVE-2016-0734

6.1MEDIUM

Key Information:

Vendor
Apache
Status
ActiveMQ
Vendor
CVE Published:
7 April 2016

Summary

The web-based administration console in Apache ActiveMQ 5.x before 5.13.2 does not send an X-Frame-Options HTTP header, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web page that contains a (1) FRAME or (2) IFRAME element.

References

https://access.redhat.com/errata/RHSA-2016:1424
vendor-advisoryx_refsource_REDHAT
http://www.securitytracker.com/id/1035327
vdb-entryx_refsource_SECTRACK
http://www.openwall.com/lists/oss-security/2016/03/10/11
mailing-listx_refsource_MLIST

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.