CVE-2010-0684

Cross-site scripting in Apache ActiveMQ

3.5 LowFix available

Cross-site scripting (XSS) vulnerability in createDestination.action in Apache ActiveMQ before 5.3.1 allows remote authenticated users to inject arbitrary web script or HTML via the JMSDestination parameter in a queue action.

Exploit likelihood

4.27%Up 1.4 points since Feb 4, 2022

What each source reports

NVD Score used 3.5

Record: CVE-2010-0684
CVSS 2.0: 3.5 LowAV:N/AC:M/Au:S/C:N/I:P/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE List No score

Record: CVE-2010-0684
Updated: 2026-11-02

EUVDEUVD-2022-4647 No score

Record: EUVD-2022-4647
Updated: 2026-11-03

GitHub AdvisoriesGHSA-mxf7-pv8q-294h No score

Cross-site scripting in Apache ActiveMQ

Record: GHSA-mxf7-pv8q-294h
Weakness: CWE-79
Updated: 2026-11-02

OSVGHSA-mxf7-pv8q-294h No score

Cross-site scripting in Apache ActiveMQ

Record: GHSA-mxf7-pv8q-294h
Weakness: CWE-79
Updated: 2026-11-02

Affected products

apache activemq

Affected packages

Affected packages
Package	Affected	Fixed
`org.apache.activemq:activemq-parent` Maven	before 5.3.1	5.3.1
`org.apache.activemq:activemq-parent` Maven	before 5.3.1, plus listed versions 4.1.14.1.25.0.05.1.05.2.05.3.0	5.3.1

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2010-0684 is a low vulnerability (CVSS 3.5) in Apache Activemq, published April 5, 2010. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.27%, the 91st percentile. Fixed in org.apache.activemq:activemq-parent 5.3.1.

References

Show 13 moreShow less