VYPR
← All advisories
Moderate severityNVD Advisory· Published Feb 12, 2015· Updated May 6, 2026

CVE-2014-8110

CVE-2014-8110

Description

Multiple cross-site scripting (XSS) vulnerabilities in the web based administration console in Apache ActiveMQ 5.x before 5.10.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.activemq:activemq-clientMaven
>= 5.0.0, < 5.10.15.10.1

Patches

2
994d9b26

https://issues.apache.org/jira/browse/AMQ-5033 - revert changes to the rss and atom feed links, as c:url doesn't escape value

https://github.com/apache/activemqDejan BosanacDec 10, 2014via ghsa
commit
1 file changed · +2 −8
  • activemq-web-console/src/main/webapp/queues.jsp+2 −8 modified
    @@ -68,14 +68,8 @@
 	                <c:param name="JMSDestination" value="${row.name}" /></c:url>">Active Consumers</a><br/>
 	<a href="<c:url value="queueProducers.jsp">
 	                <c:param name="JMSDestination" value="${row.name}" /></c:url>">Active Producers</a><br/>
-    <a href="<c:url value="queueBrowse/${row.name}">
-                    <c:param name="view" value="rss" />
-                    <c:param name="feedType" value="atom_1.0" />
-                     </c:url>" title="Atom 1.0"><img src="<c:url value="images/feed_atom.png" />" /></a>
-    <a href="<c:url value="queueBrowse/${row.name}">
-                    <c:param name="view" value="rss" />
-                    <c:param name="feedType" value="rss_2.0" />
-                    </c:url>" title="RSS 2.0"><img src="<c:url value="images/feed_rss.png" />" /></a>
+    <a href="queueBrowse/<form:escape text="${row.name}" />?view=rss&feedType=atom_1.0" title="Atom 1.0"><img src="images/feed_atom.png"/></a>
+    <a href="queueBrowse/<form:escape text="${row.name}" />?view=rss&feedType=rss_2.0" title="RSS 2.0"><img src="images/feed_rss.png"/></a>
 </td>
 <td>
     <a href="<c:url value="send.jsp">
f8b3de86d815

https://issues.apache.org/jira/browse/AMQ-5033 - revert changes to the rss and atom feed links, as c:url doesn't escape value

https://github.com/apache/activemqDejan BosanacDec 10, 2014via ghsa
commit
1 file changed · +2 −8
  • activemq-web-console/src/main/webapp/queues.jsp+2 −8 modified
    @@ -68,14 +68,8 @@
 	                <c:param name="JMSDestination" value="${row.name}" /></c:url>">Active Consumers</a><br/>
 	<a href="<c:url value="queueProducers.jsp">
 	                <c:param name="JMSDestination" value="${row.name}" /></c:url>">Active Producers</a><br/>
-    <a href="<c:url value="queueBrowse/${row.name}">
-                    <c:param name="view" value="rss" />
-                    <c:param name="feedType" value="atom_1.0" />
-                     </c:url>" title="Atom 1.0"><img src="<c:url value="images/feed_atom.png" />" /></a>
-    <a href="<c:url value="queueBrowse/${row.name}">
-                    <c:param name="view" value="rss" />
-                    <c:param name="feedType" value="rss_2.0" />
-                    </c:url>" title="RSS 2.0"><img src="<c:url value="images/feed_rss.png" />" /></a>
+    <a href="queueBrowse/<form:escape text="${row.name}" />?view=rss&feedType=atom_1.0" title="Atom 1.0"><img src="images/feed_atom.png"/></a>
+    <a href="queueBrowse/<form:escape text="${row.name}" />?view=rss&feedType=rss_2.0" title="RSS 2.0"><img src="images/feed_rss.png"/></a>
 </td>
 <td>
     <a href="<c:url value="send.jsp">

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

14

News mentions

0

No linked articles in our index yet.