{
  "@id": "urn:uuid:22fdd17b-dc42-418d-b488-19e08b5874ce",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 21,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-05T17:43:49.451449+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.activemq/activemq-web-console@6.1.6-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.activemq/activemq-web-console@6.1.6-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T16:03:43.787457+00:00",
      "status_notes": "Vulnerability CVE-2010-1587 does not affect version 6.1.6-tuxcare.3 of org.apache.activemq:activemq-web-console. not_affected \u2014 ActiveMQ 6.1.6 is NOT AFFECTED by CVE-2010-1587. The vulnerability (double-slash URI bypass allowing JSP source code disclosure) affected ActiveMQ 5.x with Jetty 6.x (circa 2010). The target uses Jetty 11.0.24 (2023-2024), which has built-in RFC 3986 URI path normalization. Jetty 11.x's HttpURI.normalizePath() automatically converts `//admin/index.jsp` to `/admin/index.jsp` before handler match...",
      "vulnerability": {
        "name": "CVE-2010-1587"
      },
      "impact_statement": "not_affected \u2014 ActiveMQ 6.1.6 is NOT AFFECTED by CVE-2010-1587. The vulnerability (double-slash URI bypass allowing JSP source code disclosure) affected ActiveMQ 5.x with Jetty 6.x (circa 2010). The target uses Jetty 11.0.24 (2023-2024), which has built-in RFC 3986 URI path normalization. Jetty 11.x's HttpURI.normalizePath() automatically converts `//admin/index.jsp` to `/admin/index.jsp` before handler match..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.activemq/activemq-web-console@6.1.6-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.activemq/activemq-web-console@6.1.6-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T22:52:23.660151+00:00",
      "status_notes": "Vulnerability CVE-2018-8006 does not affect version 6.1.6-tuxcare.3 of org.apache.activemq:activemq-web-console. not_affected \u2014 CVE-2018-8006 (XSS in queues.jsp QueueFilter parameter) is NOT present in Apache ActiveMQ 6.1.6. The vulnerability was fixed by upstream commits dd3cac8f6 (2018-07-04) and d8c80a982 (2018-08-07) which added HTML encoding via JSTL <c:out> tags to prevent script injection. These fixes were already present in the upstream release version 6.1.6 that TuxCare onboarded, confirmed by verifying both co...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-8006"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-8006 (XSS in queues.jsp QueueFilter parameter) is NOT present in Apache ActiveMQ 6.1.6. The vulnerability was fixed by upstream commits dd3cac8f6 (2018-07-04) and d8c80a982 (2018-08-07) which added HTML encoding via JSTL <c:out> tags to prevent script injection. These fixes were already present in the upstream release version 6.1.6 that TuxCare onboarded, confirmed by verifying both co..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.activemq/activemq-web-console@6.1.6-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.activemq/activemq-web-console@6.1.6-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T22:56:11.608697+00:00",
      "status_notes": "Vulnerability CVE-2020-1941 does not affect version 6.1.6-tuxcare.3 of org.apache.activemq:activemq-web-console. not_affected \u2014 CVE-2020-1941 (XSS in ActiveMQ webconsole) is not present in version 6.1.6. The vulnerability was fixed upstream in commit 81bd743ea (2020-01-23) by Apache developer Colm O hEigeartaigh, which added HTML output encoding via JSTL <c:out> tags to prevent XSS in browse.jsp and message.jsp. A follow-up encoding improvement (commit 4450c17c1, 2020-08-31) further strengthened the fix. Both fixes were...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-1941"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-1941 (XSS in ActiveMQ webconsole) is not present in version 6.1.6. The vulnerability was fixed upstream in commit 81bd743ea (2020-01-23) by Apache developer Colm O hEigeartaigh, which added HTML output encoding via JSTL <c:out> tags to prevent XSS in browse.jsp and message.jsp. A follow-up encoding improvement (commit 4450c17c1, 2020-08-31) further strengthened the fix. Both fixes were..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.activemq/activemq-web-console@6.1.6-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.activemq/activemq-web-console@6.1.6-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T17:43:49.451449+00:00",
      "status_notes": "Vulnerability CVE-2026-52760 affects version 6.1.6-tuxcare.3 of org.apache.activemq:activemq-web-console.",
      "vulnerability": {
        "name": "CVE-2026-52760"
      },
      "action_statement": "Vulnerability CVE-2026-52760 affects version 6.1.6-tuxcare.3 of org.apache.activemq:activemq-web-console."
    }
  ]
}