Search for packages
| purl | pkg:maven/org.apache.activemq/apache-artemis@2.11.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-6fqa-fzda-x3ej
Aliases: CVE-2021-26117 GHSA-9mgm-gcq8-86wq |
Improper Authentication in Apache ActiveMQ and Apache Artemis The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server. In this case, for Apache ActiveMQ Artemis prior to version 2.16.0 and Apache ActiveMQ prior to versions 5.16.1 and 5.15.14, the anonymous context is used to verify a valid users password in error, resulting in no check on the password. |
Affected by 0 other vulnerabilities. |
|
VCID-mcnd-gx42-p3gk
Aliases: CVE-2020-13932 GHSA-3h2h-xqr2-2jp7 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') In Apache ActiveMQ Artemis 2.5.0 to 2.13.0, a specially crafted MQTT packet which has an XSS payload as client-id or topic name can exploit this vulnerability. The XSS payload is being injected into the admin console's browser. The XSS payload is triggered in the diagram plugin; queue node and the info section. |
Affected by 1 other vulnerability. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||