{"document":{"aggregate_severity":{"namespace":"https://access.redhat.com/security/updates/classification/","text":"Moderate"},"category":"csaf_vex","csaf_version":"2.0","distribution":{"text":"Copyright © Red Hat, Inc. All rights reserved.","tlp":{"label":"WHITE","url":"https://www.first.org/tlp/"}},"lang":"en","notes":[{"category":"legal_disclaimer","text":"This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.","title":"Terms of Use"}],"publisher":{"category":"vendor","contact_details":"https://access.redhat.com/security/team/contact/","issuing_authority":"Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.","name":"Red Hat Product Security","namespace":"https://www.redhat.com"},"references":[{"category":"self","summary":"Canonical URL","url":"https://security.access.redhat.com/data/csaf/v2/vex/2018/cve-2018-8006.json"}],"title":"activemq: Cross-site scripting (XSS) via QueueFilter parameter","tracking":{"current_release_date":"2025-11-21T16:08:38+00:00","generator":{"date":"2025-11-21T16:08:38+00:00","engine":{"name":"Red Hat SDEngine","version":"4.6.12"}},"id":"CVE-2018-8006","initial_release_date":"2018-08-24T00:00:00+00:00","revision_history":[{"date":"2018-08-24T00:00:00+00:00","number":"1","summary":"Initial version"},{"date":"2021-10-25T22:15:56+00:00","number":"2","summary":"Current version"},{"date":"2025-11-21T16:08:38+00:00","number":"3","summary":"Last generated version"}],"status":"final","version":"3"}},"product_tree":{"branches":[{"branches":[{"branches":[{"category":"product_name","name":"JBoss Developer Studio 11","product":{"name":"JBoss Developer Studio 11","product_id":"jboss_developer_studio_11","product_identification_helper":{"cpe":"cpe:/a:redhat:jboss_dev_studio:11."}}}],"category":"product_family","name":"JBoss Developer Studio 11"},{"branches":[{"category":"product_name","name":"Red Hat Decision Manager 7","product":{"name":"Red Hat Decision Manager 7","product_id":"red_hat_decision_manager_7","product_identification_helper":{"cpe":"cpe:/a:redhat:jboss_enterprise_brms_platform:7"}}}],"category":"product_family","name":"Red Hat Decision Manager 7"},{"branches":[{"category":"product_name","name":"Red Hat Fuse 7","product":{"name":"Red Hat Fuse 7","product_id":"red_hat_fuse_7","product_identification_helper":{"cpe":"cpe:/a:redhat:jboss_fuse:7"}}}],"category":"product_family","name":"Red Hat Fuse 7"},{"branches":[{"category":"product_name","name":"Red Hat JBoss A-MQ 6","product":{"name":"Red Hat JBoss A-MQ 6","product_id":"red_hat_jboss_a-mq_6","product_identification_helper":{"cpe":"cpe:/a:redhat:jboss_amq:6"}}}],"category":"product_family","name":"Red Hat JBoss A-MQ 6"},{"branches":[{"category":"product_name","name":"Red Hat JBoss Data Grid 7","product":{"name":"Red Hat JBoss Data Grid 7","product_id":"red_hat_jboss_data_grid_7","product_identification_helper":{"cpe":"cpe:/a:redhat:jboss_data_grid:7"}}}],"category":"product_family","name":"Red Hat JBoss Data Grid 7"},{"branches":[{"category":"product_name","name":"Red Hat JBoss Enterprise Application Platform 7","product":{"name":"Red Hat JBoss Enterprise Application Platform 7","product_id":"red_hat_jboss_enterprise_application_platform_7","product_identification_helper":{"cpe":"cpe:/a:redhat:jboss_enterprise_application_platform:7"}}}],"category":"product_family","name":"Red Hat JBoss Enterprise Application Platform 7"},{"branches":[{"category":"product_name","name":"Red Hat JBoss Fuse 6","product":{"name":"Red Hat JBoss Fuse 6","product_id":"red_hat_jboss_fuse_6","product_identification_helper":{"cpe":"cpe:/a:redhat:jboss_fuse:6"}}}],"category":"product_family","name":"Red Hat JBoss Fuse 6"},{"branches":[{"category":"product_name","name":"Red Hat JBoss Fuse Service Works 6","product":{"name":"Red Hat JBoss Fuse Service Works 6","product_id":"red_hat_jboss_fuse_service_works_6","product_identification_helper":{"cpe":"cpe:/a:redhat:jboss_fuse_service_works:6"}}}],"category":"product_family","name":"Red Hat JBoss Fuse Service Works 6"},{"branches":[{"category":"product_name","name":"Red Hat Process Automation 7","product":{"name":"Red Hat Process Automation 7","product_id":"red_hat_process_automation_7","product_identification_helper":{"cpe":"cpe:/a:redhat:jboss_enterprise_bpms_platform:7"}}}],"category":"product_family","name":"Red Hat Process Automation 7"},{"branches":[{"category":"product_name","name":"Red Hat Single Sign-On 7","product":{"name":"Red Hat Single Sign-On 7","product_id":"red_hat_single_sign-on_7","product_identification_helper":{"cpe":"cpe:/a:redhat:red_hat_single_sign_on:7"}}}],"category":"product_family","name":"Red Hat Single Sign-On 7"},{"branches":[{"category":"product_name","name":"Red Hat Virtualization 4","product":{"name":"Red Hat Virtualization 4","product_id":"red_hat_virtualization_4","product_identification_helper":{"cpe":"cpe:/o:redhat:rhev_hypervisor:4"}}}],"category":"product_family","name":"Red Hat Virtualization 4"},{"category":"product_version","name":"activemq","product":{"name":"activemq","product_id":"activemq"}},{"category":"product_version","name":"activemq-artemis","product":{"name":"activemq-artemis","product_id":"activemq-artemis"}},{"category":"product_version","name":"eap7-activemq-artemis","product":{"name":"eap7-activemq-artemis","product_id":"eap7-activemq-artemis","product_identification_helper":{"purl":"pkg:rpm/redhat/eap7-activemq-artemis?arch=src"}}}],"category":"vendor","name":"Red Hat"}],"relationships":[{"category":"default_component_of","full_product_name":{"name":"activemq as a component of JBoss Developer Studio 11","product_id":"jboss_developer_studio_11:activemq"},"product_reference":"activemq","relates_to_product_reference":"jboss_developer_studio_11"},{"category":"default_component_of","full_product_name":{"name":"activemq-artemis as a component of Red Hat Decision Manager 7","product_id":"red_hat_decision_manager_7:activemq-artemis"},"product_reference":"activemq-artemis","relates_to_product_reference":"red_hat_decision_manager_7"},{"category":"default_component_of","full_product_name":{"name":"activemq as a component of Red Hat Fuse 7","product_id":"red_hat_fuse_7:activemq"},"product_reference":"activemq","relates_to_product_reference":"red_hat_fuse_7"},{"category":"default_component_of","full_product_name":{"name":"activemq as a component of Red Hat JBoss A-MQ 6","product_id":"red_hat_jboss_a-mq_6:activemq"},"product_reference":"activemq","relates_to_product_reference":"red_hat_jboss_a-mq_6"},{"category":"default_component_of","full_product_name":{"name":"activemq-artemis as a component of Red Hat JBoss Data Grid 7","product_id":"red_hat_jboss_data_grid_7:activemq-artemis"},"product_reference":"activemq-artemis","relates_to_product_reference":"red_hat_jboss_data_grid_7"},{"category":"default_component_of","full_product_name":{"name":"activemq-artemis as a component of Red Hat JBoss Enterprise Application Platform 7","product_id":"red_hat_jboss_enterprise_application_platform_7:activemq-artemis"},"product_reference":"activemq-artemis","relates_to_product_reference":"red_hat_jboss_enterprise_application_platform_7"},{"category":"default_component_of","full_product_name":{"name":"activemq as a component of Red Hat JBoss Fuse 6","product_id":"red_hat_jboss_fuse_6:activemq"},"product_reference":"activemq","relates_to_product_reference":"red_hat_jboss_fuse_6"},{"category":"default_component_of","full_product_name":{"name":"activemq as a component of Red Hat JBoss Fuse Service Works 6","product_id":"red_hat_jboss_fuse_service_works_6:activemq"},"product_reference":"activemq","relates_to_product_reference":"red_hat_jboss_fuse_service_works_6"},{"category":"default_component_of","full_product_name":{"name":"activemq-artemis as a component of Red Hat Process Automation 7","product_id":"red_hat_process_automation_7:activemq-artemis"},"product_reference":"activemq-artemis","relates_to_product_reference":"red_hat_process_automation_7"},{"category":"default_component_of","full_product_name":{"name":"activemq-artemis as a component of Red Hat Single Sign-On 7","product_id":"red_hat_single_sign-on_7:activemq-artemis"},"product_reference":"activemq-artemis","relates_to_product_reference":"red_hat_single_sign-on_7"},{"category":"default_component_of","full_product_name":{"name":"eap7-activemq-artemis as a component of Red Hat Virtualization 4","product_id":"red_hat_virtualization_4:eap7-activemq-artemis"},"product_reference":"eap7-activemq-artemis","relates_to_product_reference":"red_hat_virtualization_4"}]},"vulnerabilities":[{"cve":"CVE-2018-8006","cwe":{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"},"discovery_date":"2018-08-28T00:00:00+00:00","flags":[{"label":"vulnerable_code_not_present","product_ids":["red_hat_decision_manager_7:activemq-artemis","red_hat_jboss_data_grid_7:activemq-artemis","red_hat_jboss_enterprise_application_platform_7:activemq-artemis","red_hat_process_automation_7:activemq-artemis","red_hat_single_sign-on_7:activemq-artemis","red_hat_virtualization_4:eap7-activemq-artemis"]}],"ids":[{"system_name":"Red Hat Bugzilla ID","text":"1622774"}],"notes":[{"category":"description","text":"An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the queue.jsp page of Apache ActiveMQ versions 5.0.0 to 5.15.5. The root cause of this issue is improper data filtering of the QueueFilter parameter.","title":"Vulnerability description"},{"category":"summary","text":"activemq: Cross-site scripting (XSS) via QueueFilter parameter","title":"Vulnerability summary"},{"category":"other","text":"Red Hat Single Sign-On does not include the vulnerable web console components.","title":"Statement"},{"category":"general","text":"The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.","title":"CVSS score applicability"}],"product_status":{"known_affected":["jboss_developer_studio_11:activemq","red_hat_fuse_7:activemq","red_hat_jboss_a-mq_6:activemq","red_hat_jboss_fuse_6:activemq","red_hat_jboss_fuse_service_works_6:activemq"],"known_not_affected":["red_hat_decision_manager_7:activemq-artemis","red_hat_jboss_data_grid_7:activemq-artemis","red_hat_jboss_enterprise_application_platform_7:activemq-artemis","red_hat_process_automation_7:activemq-artemis","red_hat_single_sign-on_7:activemq-artemis","red_hat_virtualization_4:eap7-activemq-artemis"]},"references":[{"category":"self","summary":"Canonical URL","url":"https://access.redhat.com/security/cve/CVE-2018-8006"},{"category":"external","summary":"RHBZ#1622774","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1622774"},{"category":"external","summary":"https://www.cve.org/CVERecord?id=CVE-2018-8006","url":"https://www.cve.org/CVERecord?id=CVE-2018-8006"},{"category":"external","summary":"https://nvd.nist.gov/vuln/detail/CVE-2018-8006","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-8006"},{"category":"external","summary":"https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2018-008/?fid=11632","url":"https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2018-008/?fid=11632"}],"release_date":"2018-08-24T00:00:00+00:00","remediations":[{"category":"no_fix_planned","details":"Out of support scope","product_ids":["jboss_developer_studio_11:activemq","red_hat_jboss_a-mq_6:activemq","red_hat_jboss_fuse_6:activemq","red_hat_jboss_fuse_service_works_6:activemq"]},{"category":"no_fix_planned","details":"Will not fix","product_ids":["red_hat_fuse_7:activemq"]}],"scores":[{"cvss_v3":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.0"},"products":["jboss_developer_studio_11:activemq","red_hat_decision_manager_7:activemq-artemis","red_hat_fuse_7:activemq","red_hat_jboss_a-mq_6:activemq","red_hat_jboss_data_grid_7:activemq-artemis","red_hat_jboss_enterprise_application_platform_7:activemq-artemis","red_hat_jboss_fuse_6:activemq","red_hat_jboss_fuse_service_works_6:activemq","red_hat_process_automation_7:activemq-artemis","red_hat_single_sign-on_7:activemq-artemis","red_hat_virtualization_4:eap7-activemq-artemis"]}],"threats":[{"category":"impact","details":"Moderate","product_ids":["jboss_developer_studio_11:activemq","red_hat_decision_manager_7:activemq-artemis","red_hat_fuse_7:activemq","red_hat_jboss_a-mq_6:activemq","red_hat_jboss_data_grid_7:activemq-artemis","red_hat_jboss_enterprise_application_platform_7:activemq-artemis","red_hat_jboss_fuse_6:activemq","red_hat_jboss_fuse_service_works_6:activemq","red_hat_process_automation_7:activemq-artemis","red_hat_single_sign-on_7:activemq-artemis","red_hat_virtualization_4:eap7-activemq-artemis"]}],"title":"activemq: Cross-site scripting (XSS) via QueueFilter parameter"}]}