CVE-2022-35278: HTML Injection in ActiveMQ Artemis Web Console

August 24, 2022 (updated July 8, 2026)

In Apache ActiveMQ Artemis prior to 2.24.0, an attacker could show malicious content and/or redirect users to a malicious URL in the web console by using HTML in the name of an address or queue.

References

github.com/advisories/GHSA-cv6r-h2fm-pvrp
lists.apache.org/thread/bh6y81wtotg75337bpvxcjy436zfgf3n
nvd.nist.gov/vuln/detail/CVE-2022-35278
security.netapp.com/advisory/ntap-20221209-0005

Code Behaviors & Features

Detect and mitigate CVE-2022-35278 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →