PkgSeer

Vulnerability GHSA-f892-4h9f-j7g9

High Risk

4 months ago

Apache ActiveMQ Improper Authorization vulnerability

4.1.1 - 5.19.7 and 6.0.0 - 6.2.6

Summary

Apache ActiveMQ Improper Authorization vulnerability

Details

Improper Authorization vulnerability in Apache ActiveMQ.

An authenticated low-privilege Web Console user by default can access /admin/* paths in the Web Console. The default Jetty settings incorrectly did not limit those paths to only admins. This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7.

Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All has a Memory Allocation with Excessive Size Value vulnerability

4.1.1 - 5.19.7 and 6.0.0 - 6.2.6 GHSA-7259-vf48-52q3

Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All have a Denial of Service via Out of Memory vulnerability

5.19.7 and 6.2.6 GHSA-9qj4-v6r6-3wmx

Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker have Memory Allocation with Excessive Size Value vulnerability

4.1.1 - 5.19.7 and 6.0.0 - 6.2.6 GHSA-f77w-px59-cqf5

Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All have an Improper Input Validation vulnerability

4.1.1 - 5.19.7 and 6.0.0 - 6.2.6 GHSA-h5gm-rvw6-2xpx

Apache ActiveMQ has an Incorrect Default Permissions vulnerability

4.1.1 - 5.19.6 and 6.0.0 - 6.2.5 GHSA-99qx-5qqr-4j95

View all vulnerabilities for these packages

Impacted packages

org.apache.activemq:apache-activemq

Timeline

Published

4 months ago

Fixed (5.19.8)

Unknown

Fixed (6.2.7)

Unknown

Last Modified

4 hours ago