CVE-2018-8006

High PUBLISHED

An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the queue.jsp page of...

Apache Software Foundation · Apache ActiveMQ

Not yet in CISA KEV

Exploited in the wild PoC available

Recommended Action

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

View KEV Feed Talk to Sales

Confidence

High

Exploitation Status

Exploited in the wild

Observed in Sensors

Attempts (30d)

—

Unique Attacker IPs

—

CISA KEV

Not yet in CISA KEV

CVSS / EPSS

6.1 Medium

At a Glance

An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the queue.jsp page of Apache ActiveMQ versions 5.0.0 to 5.15.5. The root cause of this issue is improper data filtering of the QueueFilter parameter.

nuclei_scanner

CVE Published: Oct 10, 2018
Exploitation Reported: Oct 10, 2018
CVSS: 6.1 Medium
EPSS: —

Remote Low complexity Unauthenticated

Affected Versions

Vendor	Product	Version	Status
Apache Software Foundation	Apache ActiveMQ	5.0.0 to 5.15.5	Affected

CVE References

105156 securityfocus.com · VDB Entry http://www.securityfocus.com/bid/105156
[activemq-commits] 20190327 [CONF] Apache ActiveMQ > Security Advisories lists.apache.org · Mailing List https://lists.apache.org/thread.html/2b5c0039197a4949f29e1e2c9441ab38...
[activemq-dev] 20190327 Re: Website lists.apache.org · Mailing List https://lists.apache.org/thread.html/fcbe6ad00f1de142148c20d813fae376...
[activemq-commits] 20190327 svn commit: r1042639 - in /websites/production/activemq/content/activemq-website: ./ projects/artemis/download/ projects/classic/download/ projects/cms/download/ security-advisories.data/ lists.apache.org · Mailing List https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c269716...
[activemq-dev] 20190328 Re: Website lists.apache.org · Mailing List https://lists.apache.org/thread.html/03f91b1fb85686a848cee6b90112cf60...

Show 5 more references

[activemq-gitbox] 20191021 [GitHub] [activemq-website] clebertsuconic commented on a change in pull request #17: Fix the ordering in the security advisories page lists.apache.org · Mailing List https://lists.apache.org/thread.html/3f1e41bc9153936e065ca3094bd89ff8...
[activemq-gitbox] 20191022 [GitHub] [activemq-website] coheigea commented on a change in pull request #17: Fix the ordering in the security advisories page lists.apache.org · Mailing List https://lists.apache.org/thread.html/c0ec53b72b3240b187afb1cf67e4309a...
[activemq-commits] 20200514 [activemq-website] branch master updated: Publish CVE-2020-1941 security advisory lists.apache.org · Mailing List https://lists.apache.org/thread.html/rb698ed085f79e56146ca24ab359c9ef...
[activemq-commits] 20210208 [activemq-website] branch master updated: Publish CVE-2020-13947 lists.apache.org · Mailing List https://lists.apache.org/thread.html/r946488fb942fd35c6a6e0359f52504a...
activemq.apache.org/security-advisories.data/CVE-2018-8006-annou... activemq.apache.org · CVE Record http://activemq.apache.org/security-advisories.data/CVE-2018-8006-ann...

Recommended Actions

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.
Check enrichment artifacts for scanner coverage and available PoCs before rolling remediation validation.
Use the Pro API to automate enrichment, telemetry, and workflow delivery for VM, SOC, and CTI pipelines.

Known Exploited Vulnerability Sources

Catalogues that list this CVE as a known exploited vulnerability.

Per-source evidence links for KEV attestations are available through the KEVIntel Pro API.

Learn about Pro API access

Source	Added
The Shadowserver First	2018-10-10 14:00 UTC

Scanner Artifacts

Nuclei and Metasploit references linked to this CVE.

Scanner	Reference	Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-8006.yaml	Apr 25, 2025

CVSS Scores

CVSS v3.1 6.1 Medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS v2.0 4.3 Medium

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitation Status

Exploited in the wild

Recorded 2018-10-10 14:00:00 UTC · The Shadowserver

Proof of concept available

Recorded 2026-06-12 14:20:11 UTC · Nuclei Templates

Weaknesses (CWE)

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Scanner Integrations

Scanner	Reference	Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-8006.yaml	Apr 25, 2025

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

Apache ActiveMQ <=5.15.5 - Cross-Site Scripting

nuclei · Created Unknown

Automate This Intelligence with the Pro API

Confidence scoring, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro Pricing View API Docs

Pro API Example

GET /api/v2/pro/kevs/CVE-2018-8006

{
  "cve_id": "CVE-2018-8006",
  "title": "An instance of a cross-site scripting vulnerability was identified to be pres...",
  "affected_vendor": "Apache Software Foundation",
  "affected_product": "Apache ActiveMQ",
  "affected_versions": [
    { "vendor": "...", "product": "...", "status": "affected", "display_label": "..." }
  ],
  "confidence": "High",
  "cvss_score": 6.1,
  "epss_score": null,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "...": "Pro API fields" },
  "proof_of_concepts": [ "..." ],
  "scanner_integrations": [ "..." ]
}

The free JSON API returns basic KEV fields only. Confidence, telemetry, and artifact enrichment require Pro API access.

CVE-2018-8006

At a Glance

Affected Versions

CVE References

Recommended Actions

Known Exploited Vulnerability Sources

Scanner Artifacts

Virtual Patch

CVSS Scores

Exploitation Status

Weaknesses (CWE)

Scanner Integrations

Potential Proof of Concepts

Timeline

Automate This Intelligence with the Pro API