This vulnerability involves improper neutralization of script-related HTML tags in the Apache ActiveMQ web console. Specifically, an authenticated user can manipulate the content type to HTML instead of XML and inject HTML into a JMS selector field, resulting in reflected XSS. The vulnerability affects Apache ActiveMQ versions prior to 5.19.6 and from 6.0.0 up to but not including 6.2.5. The CVSS 3.1 base score is 6.5 (medium), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and limited confidentiality and integrity impact. The vendor recommends upgrading to fixed versions 5.19.6 or 6.2.5 to remediate this issue.

Successful exploitation allows an authenticated attacker to inject malicious HTML content in the web console interface, potentially leading to limited confidentiality and integrity impacts such as session hijacking or content manipulation. There is no impact on availability. The attack requires authentication and can be performed remotely over the network.

Users should upgrade Apache ActiveMQ to version 5.19.6 or 6.2.5 or later, where this vulnerability has been fixed. Patch status is confirmed by the vendor's recommendation to upgrade to these versions. No other mitigations or temporary fixes are indicated.