CVE-2018-8006
Apache ActiveMQ web console vulnerable to Cross-site Scripting
CVE-2018-8006 is a medium vulnerability (CVSS 6.1) in Apache Activemq, published October 10, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 55.7%, the 99th percentile. Fixed in org.apache.activemq:activemq-web-console 5.15.6.
An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the queue.jsp page of Apache ActiveMQ versions 5.0.0 to 5.15.5. The root cause of this issue is improper data filtering of the QueueFilter parameter.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the queue.jsp page of Apache ActiveMQ versions 5.0.0 to 5.15.5. The root cause of this issue is improper data filtering of the QueueFilter parameter.
- Record
CVE-2018-8006- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the queue.jsp page of Apache ActiveMQ versions 5.0.0 to 5.15.5. The root cause of this issue is improper data filtering of the QueueFilter parameter.
- Record
CVE-2018-8006- Updated
- 2026-11-02
EUVDEUVD-2018-0620 No score
An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the queue.jsp page of Apache ActiveMQ versions 5.0.0 to 5.15.5. The root cause of this issue is improper data filtering of the QueueFilter parameter.
- Record
EUVD-2018-0620- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hvwm-2624-rp9x
Apache ActiveMQ web console vulnerable to Cross-site Scripting
An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the queue.jsp page of Apache ActiveMQ versions 5.0.0 to 5.15.5. The root cause of this issue is improper data filtering of the QueueFilter parameter.
- Record
GHSA-hvwm-2624-rp9x- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the queue.jsp page of Apache ActiveMQ versions 5.0.0 to 5.15.5. The root cause of this issue is improper data filtering of the QueueFilter parameter.
- Record
CVE-2018-8006- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-8006
An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the queue.jsp page of Apache ActiveMQ versions 5.0.0 to 5.15.5. The root cause of this issue is improper data filtering of the QueueFilter parameter.
- Record
DEBIAN-CVE-2018-8006- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-hvwm-2624-rp9x
Apache ActiveMQ web console vulnerable to Cross-site Scripting
An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the queue.jsp page of Apache ActiveMQ versions 5.0.0 to 5.15.5. The root cause of this issue is improper data filtering of the QueueFilter parameter.
- Record
GHSA-hvwm-2624-rp9x- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-8006
An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the queue.jsp page of Apache ActiveMQ versions 5.0.0 to 5.15.5. The root cause of this issue is improper data filtering of the QueueFilter parameter.
- Record
UBUNTU-CVE-2018-8006- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.activemq:activemq-web-consoleMaven |
5.0.0 up to 5.15.6 | 5.15.6 |
activemqDebian:12 |
before 5.15.6-1 | 5.15.6-1 |
activemqDebian:13 |
before 5.15.6-1 | 5.15.6-1 |
org.apache.activemq:activemq-web-consoleMaven |
5.0.0 up to 5.15.6, plus listed versions 5.1.05.10.05.10.15.10.25.11.0 Show 41 moreShow less5.11.15.11.25.11.35.11.45.12.05.12.15.12.25.12.35.13.05.13.15.13.25.13.35.13.45.13.55.14.05.14.15.14.25.14.35.14.45.14.55.15.05.15.15.15.25.15.35.15.45.15.55.2.05.3.05.3.15.3.25.4.05.4.15.4.25.4.35.5.05.5.15.6.05.7.05.8.05.9.05.9.1 |
5.15.6 |
activemqUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 5.6.0+dfsg1-4+deb8u1ubuntu15.6.0+dfsg1-55.13.2+dfsg-25.13.2+dfsg-2ubuntu0.1~esm1 |
None known |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Nuclei | Apache ActiveMQ <=5.15.5 - Cross-Site Scripting |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, Nuclei, NVD, OSV |
References
activemq.apache.org/security-advisories.data/CVE-2018-8006-announcement.txt
securityfocus.com/bid/105156
lists.apache.org/thread.html/2b5c0039197a4949f29e1e2c9441ab38d242946b966f61c110808bcc%40%3Ccommits.activemq.apache.org%3E
Show 22 moreShow less
nvd.nist.gov/vuln/detail/CVE-2018-8006
github.com/apache/activemq/commit/2373aa1
issues.apache.org/jira/browse/AMQ-6954
web.archive.org/web/20200227115717/http://www.securityfocus.com/bid/105156
security-tracker.debian.org/tracker/CVE-2018-8006
ubuntu.com/security/CVE-2018-8006
cve.org/CVERecord?id=CVE-2018-8006