CVE-2022-35278
Published: 23 August 2022
Summary
CVE-2022-35278 is a medium-severity Basic XSS (CWE-80) vulnerability in Apache Activemq Artemis. Its CVSS base score is 6.1 (Medium).
Operationally, ranked in the top 7.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2022-35278 is a cross-site scripting vulnerability affecting the web console of Apache ActiveMQ Artemis versions prior to 2.24.0. The flaw stems from insufficient neutralization of HTML content supplied in the names of addresses or queues, which are then rendered directly in the console interface. It is tracked under CWE-79 and CWE-80 and carries a CVSS 3.1 base score of 6.1.
An unauthenticated attacker can create an address or queue whose name contains crafted HTML or JavaScript. When an administrator subsequently views the console, the malicious markup executes in the user's browser context, enabling display of arbitrary content or redirection to an attacker-controlled site. The attack requires user interaction but no prior authentication or special privileges.
Advisories from the Apache project and NetApp recommend upgrading to ActiveMQ Artemis 2.24.0 or later, where the input sanitization issue has been resolved. The EPSS score has remained flat at 0.0786 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-6543
Vulnerability details
In Apache ActiveMQ Artemis prior to 2.24.0, an attacker could show malicious content and/or redirect users to a malicious URL in the web console by using HTML in the name of an address or queue.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.
Validates web inputs to reject script-related content that could produce XSS.
Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.