Maven package
org.apache.activemq/activemq-parent
pkg:maven/org.apache.activemq/activemq-parent
Vulnerabilities (7)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2020-13947 | — | >= 5.16.0, < 5.16.1 | 5.16.1 | Feb 8, 2021 | An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the message.jsp page of Apache ActiveMQ versions 5.15.12 through 5.16.0. | ||
| CVE-2021-26117 | Hig | 7.5 | >= 5.16.0, < 5.16.1 | 5.16.1 | Jan 27, 2021 | The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server. In this case, for Apache ActiveMQ Artemis prior to version 2.16.0 and Apache ActiveMQ prior to versions 5.16.1 and 5.15.14, the anonymous context is used to verify a valid users | |
| CVE-2020-11998 | — | >= 5.15.12, < 5.15.13 | 5.15.13 | Sep 10, 2020 | A regression has been introduced in the commit preventing JMX re-bind. By passing an empty environment map to RMIConnectorServer, instead of the map that contains the authentication credentials, it leaves ActiveMQ open to the following attack: https://docs.oracle.com/javase/8/doc | ||
| CVE-2020-13920 | — | < 5.15.12 | 5.15.12 | Sep 10, 2020 | Apache ActiveMQ uses LocateRegistry.createRegistry() to create the JMX RMI registry and binds the server to the "jmxrmi" entry. It is possible to connect to the registry without authentication and call the rebind method to rebind jmxrmi to something else. If an attacker creates a | ||
| CVE-2017-15709 | Low | 3.7 | >= 5.15.0, < 5.15.3 | 5.15.3 | Feb 13, 2018 | When using the OpenWire protocol in ActiveMQ versions 5.14.0 to 5.15.2 it was found that certain system details (such as the OS and kernel version) are exposed as plain text. | |
| CVE-2010-1244 | — | < 5.3.1 | 5.3.1 | Apr 5, 2010 | Cross-site request forgery (CSRF) vulnerability in createDestination.action in Apache ActiveMQ before 5.3.1 allows remote attackers to hijack the authentication of unspecified victims for requests that create queues via the JMSDestination parameter in a queue action. | ||
| CVE-2010-0684 | — | < 5.3.1 | 5.3.1 | Apr 5, 2010 | Cross-site scripting (XSS) vulnerability in createDestination.action in Apache ActiveMQ before 5.3.1 allows remote authenticated users to inject arbitrary web script or HTML via the JMSDestination parameter in a queue action. |
- CVE-2020-13947Feb 8, 2021affected >= 5.16.0, < 5.16.1fixed 5.16.1
An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the message.jsp page of Apache ActiveMQ versions 5.15.12 through 5.16.0.
- affected >= 5.16.0, < 5.16.1fixed 5.16.1
The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server. In this case, for Apache ActiveMQ Artemis prior to version 2.16.0 and Apache ActiveMQ prior to versions 5.16.1 and 5.15.14, the anonymous context is used to verify a valid users
- CVE-2020-11998Sep 10, 2020affected >= 5.15.12, < 5.15.13fixed 5.15.13
A regression has been introduced in the commit preventing JMX re-bind. By passing an empty environment map to RMIConnectorServer, instead of the map that contains the authentication credentials, it leaves ActiveMQ open to the following attack: https://docs.oracle.com/javase/8/doc
- CVE-2020-13920Sep 10, 2020affected < 5.15.12fixed 5.15.12
Apache ActiveMQ uses LocateRegistry.createRegistry() to create the JMX RMI registry and binds the server to the "jmxrmi" entry. It is possible to connect to the registry without authentication and call the rebind method to rebind jmxrmi to something else. If an attacker creates a
- affected >= 5.15.0, < 5.15.3fixed 5.15.3
When using the OpenWire protocol in ActiveMQ versions 5.14.0 to 5.15.2 it was found that certain system details (such as the OS and kernel version) are exposed as plain text.
- CVE-2010-1244Apr 5, 2010affected < 5.3.1fixed 5.3.1
Cross-site request forgery (CSRF) vulnerability in createDestination.action in Apache ActiveMQ before 5.3.1 allows remote attackers to hijack the authentication of unspecified victims for requests that create queues via the JMSDestination parameter in a queue action.
- CVE-2010-0684Apr 5, 2010affected < 5.3.1fixed 5.3.1
Cross-site scripting (XSS) vulnerability in createDestination.action in Apache ActiveMQ before 5.3.1 allows remote authenticated users to inject arbitrary web script or HTML via the JMSDestination parameter in a queue action.