| CVE-2016-0734: ActiveMQ Web Console - Clickjacking |
| |
| Severity: Important |
| |
| Vendor: |
| The Apache Software Foundation |
| |
| Versions Affected: |
| Apache ActiveMQ 5.0.0 - 5.13.1 |
| |
| Description: |
| The web based administration console does not set the X-Frame-Options header in HTTP responses. This allows the console to be embedded in a frame or iframe which could then be used to cause a user to perform an unintended action in the console. |
| |
| |
| Mitigation: |
| Upgrade to Apache ActiveMQ 5.13.2 |
| |
| Credit: |
| This issue was discovered by Michael Furman |
