vulnerability
Apache ActiveMQ: CVE-2016-0734: Vulnerability in Apache ActiveMQ
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 4 | (AV:N/AC:M/Au:N/C:N/I:P/A:N) | Apr 7, 2016 | Jan 9, 2024 | Mar 25, 2026 |
Severity
4
CVSS
(AV:N/AC:M/Au:N/C:N/I:P/A:N)
Published
Apr 7, 2016
Added
Jan 9, 2024
Modified
Mar 25, 2026
Description
The web-based administration console in Apache ActiveMQ 5.x before 5.13.2 does not send an X-Frame-Options HTTP header, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web page that contains a (1) FRAME or (2) IFRAME element.
Solution
apache-activemq-upgrade-latest
References
- CVE-2016-0734
- https://attackerkb.com/topics/CVE-2016-0734
- http://activemq.apache.org/security-advisories.data/CVE-2016-0734-announcement.txt
- http://www.openwall.com/lists/oss-security/2016/03/10/11
- http://www.securityfocus.com/bid/84321
- http://www.securitytracker.com/id/1035327
- https://access.redhat.com/errata/RHSA-2016:1424
- https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apache.org%3E
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-5498
Rapid7 Labs
2026 Global Threat Landscape Report
The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.