This vulnerability involves improper neutralization of script-related HTML tags (CWE-79) in Apache ActiveMQ's web console. Specifically, an authenticated user can manipulate the JMS selector field to inject HTML content and override the content type to HTML instead of XML, enabling cross-site scripting attacks when browsing queues. The flaw affects Apache ActiveMQ versions prior to 5.19.6 and 6.0.0 prior to 6.2.5. The vendor has released fixed versions 5.19.6 and 6.2.5 to address this issue.

An authenticated attacker can execute cross-site scripting attacks by injecting malicious HTML content into the web console's queue browsing interface. This could lead to the execution of arbitrary scripts in the context of the victim's browser session, potentially resulting in session hijacking or other client-side attacks. However, exploitation requires authentication to the web console.

Users should upgrade Apache ActiveMQ to version 5.19.6 or 6.2.5 or later, where this vulnerability is fixed. No other official remediation or temporary fixes are indicated. Patch status is confirmed by the vendor advisory recommending these versions.