CVE-2026-41043

Katalog CVE

CVSS 6.5 · Medium EPSS 0,72%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada apache activemq, apache activemq web. Skor CVSS 3.1 6.5 (Medium) menurut CISA ADP.

Deskripsi (NVD)

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache ActiveMQ, Apache ActiveMQ Web. An authenticated attacker can show malicious content when browsing queues in the web console by overriding the content type to be HTML (instead of XML) and by injecting HTML into a JMS selector field. This issue affects Apache ActiveMQ: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ Web: before 5.19.6, from 6.0.0 before 6.2.5. Users are recommended to upgrade to version 6.2.5 or 5.19.6, which fixes the issue.

Rincian

Terbit di NVD

24 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes

EPSS (30 hari)

0,72% peluang dieksploitasi; lebih tinggi dari 52,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://activemq.apache.org/security-advisories.data/CVE-2026-41043-announcement.txt advisory vendor
• http://www.openwall.com/lists/oss-security/2026/04/23/5 mailing list