Vulnerability GHSA-99qx-5qqr-4j95

High Risk

5 months ago

Apache ActiveMQ has an Incorrect Default Permissions vulnerability

4.1.1 - 5.19.6 and 6.0.0 - 6.2.5

Summary

Apache ActiveMQ has an Incorrect Default Permissions vulnerability

Details

Incorrect Default Permissions vulnerability in Apache ActiveMQ.

This issue affects Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6.

The default Jolokia authorization settings granted non-admin (low-privilege) web-login accounts access to Jolokia operations which allowed executing broker management operations meant for admins such as addQueue and removeQueue.

Users are recommended to upgrade to version 6.2.6 or 5.19.7, which fixes the issue.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

High Risk

4 months ago

Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All has a Memory Allocation with Excessive Size Value vulnerability

4.1.1 - 5.19.7 and 6.0.0 - 6.2.6 GHSA-7259-vf48-52q3

High Risk

4 months ago

Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All have a Denial of Service via Out of Memory vulnerability

5.19.7 and 6.2.6 GHSA-9qj4-v6r6-3wmx

High Risk

4 months ago

Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker have Memory Allocation with Excessive Size Value vulnerability

4.1.1 - 5.19.7 and 6.0.0 - 6.2.6 GHSA-f77w-px59-cqf5

High Risk

4 months ago

Apache ActiveMQ Improper Authorization vulnerability

4.1.1 - 5.19.7 and 6.0.0 - 6.2.6 GHSA-f892-4h9f-j7g9

High Risk

4 months ago

Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All have an Improper Input Validation vulnerability

4.1.1 - 5.19.7 and 6.0.0 - 6.2.6 GHSA-h5gm-rvw6-2xpx

View all vulnerabilities for these packages

Impacted packages

org.apache.activemq:apache-activemq

Timeline

Published

5 months ago

Fixed (5.19.7)

Unknown

Fixed (6.2.6)

Unknown

Last Modified

3 months ago