VYPR
Get started
← All advisories
Medium severity6.1NVD Advisory· Published Apr 7, 2016· Updated May 6, 2026

CVE-2016-0734

CVE-2016-0734

Description

The web-based administration console in Apache ActiveMQ 5.x before 5.13.2 does not send an X-Frame-Options HTTP header, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web page that contains a (1) FRAME or (2) IFRAME element.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.activemq:activemq-clientMaven
>= 5.0.0, < 5.13.25.13.2

Affected products

27
  • Apache/Activemq27 versions
    cpe:2.3:a:apache:activemq:5.0.0:*:*:*:*:*:*:*+ 26 more
    • cpe:2.3:a:apache:activemq:5.0.0:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:activemq:5.1.0:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:activemq:5.10.0:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:activemq:5.10.1:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:activemq:5.10.2:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:activemq:5.11.0:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:activemq:5.11.1:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:activemq:5.11.2:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:activemq:5.12.0:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:activemq:5.12.1:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:activemq:5.12.2:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:activemq:5.13.0:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:activemq:5.2.0:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:activemq:5.3.0:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:activemq:5.3.1:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:activemq:5.3.2:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:activemq:5.4.0:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:activemq:5.4.1:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:activemq:5.4.2:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:activemq:5.4.3:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:activemq:5.5.0:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:activemq:5.5.1:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:activemq:5.6.0:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:activemq:5.7.0:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:activemq:5.8.0:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:activemq:5.9.0:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:activemq:5.9.1:*:*:*:*:*:*:*

Patches

2
028a33ea7d73

https://issues.apache.org/jira/browse/AMQ-6170

https://github.com/apache/activemqChristopher L. Shannon (cshannon)Feb 12, 2016via ghsa
commit
5 files changed · +26 −72
  • activemq-web-console/src/main/webapp/WEB-INF/web.xml+0 −10 modified
    @@ -25,16 +25,6 @@
     Apache ActiveMQ Web Console
   </description>
   <display-name>ActiveMQ Console</display-name>
-  
-  <filter>
-    <filter-name>XFrameOptions</filter-name>
-    <filter-class>org.apache.activemq.web.XFrameOptionsFilter</filter-class>
-  </filter>
-
-  <filter-mapping>
-    <filter-name>XFrameOptions</filter-name>
-    <url-pattern>/*</url-pattern>
-  </filter-mapping>
 
   <!-- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -->
   <!--              Expose Spring POJOs to JSP                   .                                                             -->
  • activemq-web-demo/src/main/webapp/WEB-INF/web.xml+0 −9 modified
    @@ -30,15 +30,6 @@
     </context-param>
 
 	<!-- filters -->
-    <filter>
-      <filter-name>XFrameOptions</filter-name>
-      <filter-class>org.apache.activemq.web.XFrameOptionsFilter</filter-class>
-    </filter>
-  
-    <filter-mapping>
-      <filter-name>XFrameOptions</filter-name>
-      <url-pattern>/*</url-pattern>
-    </filter-mapping>
 	<filter>
 		<filter-name>session</filter-name>
 		<filter-class>org.apache.activemq.web.SessionFilter</filter-class>
  • activemq-web/src/main/java/org/apache/activemq/web/XFrameOptionsFilter.java+0 −53 removed
    @@ -1,53 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one or more
- * contributor license agreements.  See the NOTICE file distributed with
- * this work for additional information regarding copyright ownership.
- * The ASF licenses this file to You under the Apache License, Version 2.0
- * (the "License"); you may not use this file except in compliance with
- * the License.  You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.activemq.web;
-
-import java.io.IOException;
-
-import javax.servlet.Filter;
-import javax.servlet.FilterChain;
-import javax.servlet.FilterConfig;
-import javax.servlet.ServletException;
-import javax.servlet.ServletRequest;
-import javax.servlet.ServletResponse;
-import javax.servlet.http.HttpServletResponse;
-
-/**
- * Filter to set the header X-FRAME-OPTIONS on web responses
- *
- */
-public class XFrameOptionsFilter implements Filter {
-
-    private static String SAMEORIGIN = "SAMEORIGIN";
-
-    @Override
-    public void init(FilterConfig config) throws ServletException {
-    }
-
-    @Override
-    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
-        HttpServletResponse servletResponse = (HttpServletResponse)response;
-        //Set all responses to SAMEORIGIN, can be switched to be configurable later if
-        //we need to conditionally set this
-        servletResponse.addHeader("X-FRAME-OPTIONS", SAMEORIGIN);
-        chain.doFilter(request, response);
-    }
-
-    @Override
-    public void destroy() {
-    }
-}
  • assembly/src/release/conf/jetty.xml+13 −0 modified
    @@ -46,9 +46,22 @@
         <property name="pathSpec" value="*.action" />
     </bean>
     
+    <bean id="rewriteHandler" class="org.eclipse.jetty.rewrite.handler.RewriteHandler">
+        <property name="rules">
+            <list>
+                <bean id="header" class="org.eclipse.jetty.rewrite.handler.HeaderPatternRule">
+                  <property name="pattern" value="*"/>
+                  <property name="name" value="X-FRAME-OPTIONS"/>
+                  <property name="value" value="SAMEORIGIN"/>
+                </bean>
+            </list>
+        </property>
+    </bean>
+    
 	<bean id="secHandlerCollection" class="org.eclipse.jetty.server.handler.HandlerCollection">
 		<property name="handlers">
 			<list>
+   	            <ref bean="rewriteHandler"/>
 				<bean class="org.eclipse.jetty.webapp.WebAppContext">
 					<property name="contextPath" value="/admin" />
 					<property name="resourceBase" value="${activemq.home}/webapps/admin" />
  • assembly/src/release/examples/conf/jetty-demo.xml+13 −0 modified
    @@ -46,9 +46,22 @@
         <property name="pathSpec" value="*.action" />
     </bean>
 
+    <bean id="rewriteHandler" class="org.eclipse.jetty.rewrite.handler.RewriteHandler">
+        <property name="rules">
+            <list>
+                <bean id="header" class="org.eclipse.jetty.rewrite.handler.HeaderPatternRule">
+                  <property name="pattern" value="*"/>
+                  <property name="name" value="X-FRAME-OPTIONS"/>
+                  <property name="value" value="SAMEORIGIN"/>
+                </bean>
+            </list>
+        </property>
+    </bean>
+    
 	<bean id="secHandlerCollection" class="org.eclipse.jetty.server.handler.HandlerCollection">
 		<property name="handlers">
 			<list>
+                <ref bean="rewriteHandler"/>
 				<bean class="org.eclipse.jetty.webapp.WebAppContext">
 					<property name="contextPath" value="/admin" />
 					<property name="resourceBase" value="${activemq.home}/webapps/admin" />
24ad36778534

https://issues.apache.org/jira/browse/AMQ-6170

https://github.com/apache/activemqChristopher L. Shannon (cshannon)Feb 12, 2016via ghsa
commit
5 files changed · +26 −72
  • activemq-web-console/src/main/webapp/WEB-INF/web.xml+0 −10 modified
    @@ -25,16 +25,6 @@
     Apache ActiveMQ Web Console
   </description>
   <display-name>ActiveMQ Console</display-name>
-  
-  <filter>
-    <filter-name>XFrameOptions</filter-name>
-    <filter-class>org.apache.activemq.web.XFrameOptionsFilter</filter-class>
-  </filter>
-
-  <filter-mapping>
-    <filter-name>XFrameOptions</filter-name>
-    <url-pattern>/*</url-pattern>
-  </filter-mapping>
 
   <!-- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -->
   <!--              Expose Spring POJOs to JSP                   .                                                             -->
  • activemq-web-demo/src/main/webapp/WEB-INF/web.xml+0 −9 modified
    @@ -30,15 +30,6 @@
     </context-param>
 
 	<!-- filters -->
-    <filter>
-      <filter-name>XFrameOptions</filter-name>
-      <filter-class>org.apache.activemq.web.XFrameOptionsFilter</filter-class>
-    </filter>
-  
-    <filter-mapping>
-      <filter-name>XFrameOptions</filter-name>
-      <url-pattern>/*</url-pattern>
-    </filter-mapping>
 	<filter>
 		<filter-name>session</filter-name>
 		<filter-class>org.apache.activemq.web.SessionFilter</filter-class>
  • activemq-web/src/main/java/org/apache/activemq/web/XFrameOptionsFilter.java+0 −53 removed
    @@ -1,53 +0,0 @@
-/**
- * Licensed to the Apache Software Foundation (ASF) under one or more
- * contributor license agreements.  See the NOTICE file distributed with
- * this work for additional information regarding copyright ownership.
- * The ASF licenses this file to You under the Apache License, Version 2.0
- * (the "License"); you may not use this file except in compliance with
- * the License.  You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.activemq.web;
-
-import java.io.IOException;
-
-import javax.servlet.Filter;
-import javax.servlet.FilterChain;
-import javax.servlet.FilterConfig;
-import javax.servlet.ServletException;
-import javax.servlet.ServletRequest;
-import javax.servlet.ServletResponse;
-import javax.servlet.http.HttpServletResponse;
-
-/**
- * Filter to set the header X-FRAME-OPTIONS on web responses
- *
- */
-public class XFrameOptionsFilter implements Filter {
-
-    private static String SAMEORIGIN = "SAMEORIGIN";
-
-    @Override
-    public void init(FilterConfig config) throws ServletException {
-    }
-
-    @Override
-    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
-        HttpServletResponse servletResponse = (HttpServletResponse)response;
-        //Set all responses to SAMEORIGIN, can be switched to be configurable later if
-        //we need to conditionally set this
-        servletResponse.addHeader("X-FRAME-OPTIONS", SAMEORIGIN);
-        chain.doFilter(request, response);
-    }
-
-    @Override
-    public void destroy() {
-    }
-}
  • assembly/src/release/conf/jetty.xml+13 −0 modified
    @@ -46,9 +46,22 @@
         <property name="pathSpec" value="*.action" />
     </bean>
     
+    <bean id="rewriteHandler" class="org.eclipse.jetty.rewrite.handler.RewriteHandler">
+        <property name="rules">
+            <list>
+                <bean id="header" class="org.eclipse.jetty.rewrite.handler.HeaderPatternRule">
+                  <property name="pattern" value="*"/>
+                  <property name="name" value="X-FRAME-OPTIONS"/>
+                  <property name="value" value="SAMEORIGIN"/>
+                </bean>
+            </list>
+        </property>
+    </bean>
+    
 	<bean id="secHandlerCollection" class="org.eclipse.jetty.server.handler.HandlerCollection">
 		<property name="handlers">
 			<list>
+   	            <ref bean="rewriteHandler"/>
 				<bean class="org.eclipse.jetty.webapp.WebAppContext">
 					<property name="contextPath" value="/admin" />
 					<property name="resourceBase" value="${activemq.home}/webapps/admin" />
  • assembly/src/release/examples/conf/jetty-demo.xml+13 −0 modified
    @@ -46,9 +46,22 @@
         <property name="pathSpec" value="*.action" />
     </bean>
 
+    <bean id="rewriteHandler" class="org.eclipse.jetty.rewrite.handler.RewriteHandler">
+        <property name="rules">
+            <list>
+                <bean id="header" class="org.eclipse.jetty.rewrite.handler.HeaderPatternRule">
+                  <property name="pattern" value="*"/>
+                  <property name="name" value="X-FRAME-OPTIONS"/>
+                  <property name="value" value="SAMEORIGIN"/>
+                </bean>
+            </list>
+        </property>
+    </bean>
+    
 	<bean id="secHandlerCollection" class="org.eclipse.jetty.server.handler.HandlerCollection">
 		<property name="handlers">
 			<list>
+                <ref bean="rewriteHandler"/>
 				<bean class="org.eclipse.jetty.webapp.WebAppContext">
 					<property name="contextPath" value="/admin" />
 					<property name="resourceBase" value="${activemq.home}/webapps/admin" />

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

11

News mentions

0

No linked articles in our index yet.