-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.activemq:activemq-client | maven | >= 5.0.0, <= 5.14.1 | 5.14.2 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from using JSTL's <c:url> tag without proper output encoding when inserting the ${row.clientId} value into href attributes across multiple JSP files. The commit diff shows replacements of <c:url> with <c:out> which performs HTML escaping, indicating the original implementation lacked contextual encoding for URL attributes. Since clientId values were user-controlled input displayed in the admin console, this allowed attackers to inject arbitrary JavaScript through malicious client IDs. All identified locations follow the same vulnerable pattern and were explicitly patched in the referenced commit.
Ongoing coverage of React2Shell