VYPR
← All advisories
Medium severity5.4NVD Advisory· Published Aug 5, 2016· Updated May 6, 2026

CVE-2016-0782

CVE-2016-0782

Description

The administration web console in Apache ActiveMQ 5.x before 5.11.4, 5.12.x before 5.12.3, and 5.13.x before 5.13.2 allows remote authenticated users to conduct cross-site scripting (XSS) attacks and consequently obtain sensitive information from a Java memory dump via vectors related to creating a queue.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.activemq:activemq-clientMaven
>= 5.0.0, < 5.11.45.11.4
org.apache.activemq:activemq-clientMaven
>= 5.12.0, < 5.12.35.12.3
org.apache.activemq:activemq-clientMaven
>= 5.13.0, < 5.13.25.13.2

Affected products

1

Patches

3
0c9fdb5b4180

Turn off jolokia discovery by default.

https://github.com/apache/activemqClaus IbsenFeb 17, 2016via ghsa
commit
1 file changed · +4 −2
  • assembly/src/release/webapps/api/WEB-INF/web.xml+4 −2 modified
    @@ -38,10 +38,11 @@
 
     <servlet>
         <servlet-name>jolokia-agent</servlet-name>
-        <servlet-class>org.jolokia.http.AgentServlet</servlet-class>        
+        <servlet-class>org.jolokia.http.AgentServlet</servlet-class>
+        <!-- Uncomment this if you want jolokia multicast discovery to be enabled         
         <init-param>
           <param-name>discoveryEnabled</param-name>
-          <param-value>false</param-value>
+          <param-value>true</param-value>
         </init-param>      
         <init-param>
           <param-name>discoveryAgentUrl</param-name>
@@ -51,6 +52,7 @@
           <param-name>agentDescription</param-name>
           <param-value>Apache ActiveMQ</param-value>
         </init-param>
+        -->
         <!-- turn off returning exceptions and stacktraces from jolokia -->
         <init-param>
           <param-name>allowErrorDetails</param-name>
2061186a0a24

Jolokia should not send back exceptions/error details by default

https://github.com/apache/activemqClaus IbsenFeb 17, 2016via ghsa
commit
1 file changed · +5 −0
  • assembly/src/release/webapps/api/WEB-INF/web.xml+5 −0 modified
    @@ -51,6 +51,11 @@
           <param-name>agentDescription</param-name>
           <param-value>Apache ActiveMQ</param-value>
         </init-param>
+        <!-- turn off returning exceptions and stacktraces from jolokia -->
+        <init-param>
+          <param-name>allowErrorDetails</param-name>
+          <param-value>false</param-value>
+        </init-param>
         <load-on-startup>1</load-on-startup> 
     </servlet>
7828069637ac

Upgrade jolokia

https://github.com/apache/activemqClaus IbsenFeb 17, 2016via ghsa
commit
1 file changed · +1 −1
  • pom.xml+1 −1 modified
    @@ -81,7 +81,7 @@
     <tomcat-api-version>8.0.24</tomcat-api-version>
     <jettison-version>1.3.7</jettison-version>
     <jmock-version>2.5.1</jmock-version>
-    <jolokia-version>1.3.2</jolokia-version>
+    <jolokia-version>1.3.3</jolokia-version>
     <josql-version>1.5_5</josql-version>
     <!-- for json-simple use same version as jolokia uses -->
     <json-simple-version>1.1.1</json-simple-version>

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

14

News mentions

0

No linked articles in our index yet.