{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:c811204f-2343-56c9-9ccb-92b40d7985a1",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "activemq-web-console",
      "purl": "pkg:maven/org.apache.activemq/activemq-web-console@6.1.8-tuxcare.2",
      "type": "library",
      "group": "org.apache.activemq",
      "bom-ref": "pkg:maven/org.apache.activemq/activemq-web-console@6.1.8-tuxcare.2",
      "version": "6.1.8-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "activemq-web-console",
            "purl": "pkg:maven/org.apache.activemq/activemq-web-console@6.1.8",
            "type": "library",
            "group": "org.apache.activemq",
            "version": "6.1.8"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2010-1587",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.activemq/activemq-web-console@6.1.8-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:2de64f38-4cca-5695-8e10-ff4ea0f98645",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2010-1587 does not affect version 6.1.8-tuxcare.2 of org.apache.activemq:activemq-web-console. not_affected \u2014 CVE-2010-1587 affects Apache ActiveMQ 5.x before 5.3.2 and 5.4.x before 5.4.0, where the Jetty ResourceHandler vulnerability allowed reading JSP source code via double-slash URIs (e.g., //admin/index.jsp). The target ActiveMQ 6.1.8-tuxcare.2 is not affected because it uses Jetty 11.0.26-tuxcare.2, which has proper URI normalization and secure JSP servlet mapping. Modern Jetty versions (7+) fixe...",
        "justification": "protected_at_runtime"
      }
    },
    {
      "id": "CVE-2018-8006",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.activemq/activemq-web-console@6.1.8-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:65aad9ba-e1f5-5429-84cd-501d23cc277c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-8006 does not affect version 6.1.8-tuxcare.2 of org.apache.activemq:activemq-web-console. not_affected \u2014 The target is NOT AFFECTED by CVE-2018-8006. The XSS vulnerability in queues.jsp has been fixed by upstream Apache ActiveMQ developers and shipped in version 6.1.8 (before TuxCare onboarding). Both vulnerable output locations now use JSTL <c:out> tag for proper HTML encoding of the QueueFilter parameter, preventing JavaScript execution.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-1941",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.activemq/activemq-web-console@6.1.8-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:71607c8c-8916-5887-9a80-b215b76e8781",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-1941 does not affect version 6.1.8-tuxcare.2 of org.apache.activemq:activemq-web-console. not_affected \u2014 CVE-2020-1941 (XSS in ActiveMQ WebConsole queue browser) is NOT present in target version 6.1.8. The vulnerability affected versions 5.0.0 to 5.15.11, where message properties were rendered unescaped in HTML attributes. The fix (commit 81bd743ea by Apache committer coheigea@apache.org, dated 2020-01-23) was already included in the upstream ActiveMQ 6.1.8 release that TuxCare onboarded. The targ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-52760",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.activemq/activemq-web-console@6.1.8-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:be0aacb8-0f9f-532d-88fd-4e33cdfc8e24",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-52760 affects version 6.1.8-tuxcare.2 of org.apache.activemq:activemq-web-console."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.activemq/activemq-web-console@6.1.8-tuxcare.2"
    }
  ]
}