{"id":"CVE-2013-1879","aliases":["EUVD-2022-4549","GHSA-mfhr-3xmc-r2gg"],"status":"published","title":"Improper Neutralization of Input During Web Page Generation in Apache ActiveMQ","description":"Cross-site scripting (XSS) vulnerability in scheduled.jsp in Apache ActiveMQ 5.8.0 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors involving the \"cron of a message.\"","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.06421,"percentile":0.93744,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2013-07-18T01:00:00Z","modified":"2026-06-16T23:52:17Z","fixes":[{"ecosystem":"Maven","package":"org.apache.activemq:activemq-client","fixed_in":["5.9.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.activemq:activemq-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.0"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.activemq:activemq-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.0"}]}],"versions":["5.8.0"]}],"products":[{"vendor":"apache","product":"activemq"}],"references":[{"url":"http://rhn.redhat.com/errata/RHSA-2013-1029.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","web"]},{"url":"http://secunia.com/advisories/54073","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","web"]},{"url":"https://issues.apache.org/jira/browse/AMQ-4397","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","web"]},{"url":"http://www.securityfocus.com/bid/61142","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/85586","tags":["vdb-entry","x_refsource_XF","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-1879","tags":["advisory"]},{"url":"https://github.com/apache/activemq/commit/148ca81dcd8f14cfe2ff37012fd1aa42518f02dc","tags":["web"]},{"url":"https://github.com/advisories/GHSA-mfhr-3xmc-r2gg"},{"url":"https://github.com/apache/activemq","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2013-1879","description":"Cross-site scripting (XSS) vulnerability in scheduled.jsp in Apache ActiveMQ 5.8.0 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors involving the \"cron of a message.\"","status":"published","published":"2013-07-18T01:00:00Z","modified":"2024-08-06T15:20:36.68Z","updated_at":"2026-11-02T14:34:58.882751Z"}],"euvd":[{"id":"EUVD-2022-4549","description":"Cross-site scripting (XSS) vulnerability in scheduled.jsp in Apache ActiveMQ 5.8.0 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors involving the \"cron of a message.\"","status":"published","published":"2013-07-18T01:00:00Z","modified":"2024-08-06T15:20:36Z","updated_at":"2026-11-03T01:56:40.540333Z"}],"ghsa":[{"id":"GHSA-mfhr-3xmc-r2gg","title":"Improper Neutralization of Input During Web Page Generation in Apache ActiveMQ","description":"Cross-site scripting (XSS) vulnerability in scheduled.jsp in Apache ActiveMQ 5.8.0 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors involving the \"cron of a message.\"","status":"published","published":"2022-05-17T01:36:25Z","modified":"2023-12-20T18:48:07Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:37:27.414424Z"}],"nvd":[{"id":"CVE-2013-1879","description":"Cross-site scripting (XSS) vulnerability in scheduled.jsp in Apache ActiveMQ 5.8.0 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors involving the \"cron of a message.\"","status":"published","published":"2013-07-20T03:37:08.867Z","modified":"2026-06-16T23:52:17.667Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:02:31.592595Z"}],"osv":[{"id":"GHSA-mfhr-3xmc-r2gg","title":"Improper Neutralization of Input During Web Page Generation in Apache ActiveMQ","description":"Cross-site scripting (XSS) vulnerability in scheduled.jsp in Apache ActiveMQ 5.8.0 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors involving the \"cron of a message.\"","status":"published","published":"2022-05-17T01:36:25Z","modified":"2024-12-07T05:38:26.754799Z","cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:51.811331Z"}]}}