Apache Software Foundation Apache ActiveMQ vulnerability
Apache Software FoundationApache ActiveMQ
- Not in CISA KEV
- Vendor fix available
Higher than 94% of scored CVEs
Description NVD
In Apache ActiveMQ 6.x, the default configuration doesn't secure the API web context (where the Jolokia JMX REST API and the Message REST API are located). It means that anyone can use these layers without any required authentication. Potentially, anyone can interact with the broker (using Jolokia JMX REST API) and/or produce/consume messages or purge/delete destinations (using the Message REST API). To mitigate, users can update the default conf/jetty.xml configuration file to add authentication requirement: <bean id="securityConstraintMapping" class="org.eclipse.jetty.security.ConstraintMapping"> <property name="constraint" ref="securityConstraint" /> <property name="pathSpec" value="/" /> </bean> Or we encourage users to upgrade to Apache ActiveMQ 6.1.2 where the default configuration has been updated with authentication by default.
Coverage 2 articles · 2 outlets
See the full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Wed 8 Apr · 10:31 UTC | Infosecurity | AI powered tool finds decade old Apache ActiveMQ Classic RCE flaw |
| Wed 8 Apr · 15:01 UTC | SecurityWeek | RCE Bug Lurked in Apache ActiveMQ Classic for 13 Years |
- RCE Bug Lurked in Apache ActiveMQ Classic for 13 YearsSecurityWeek · mentions it in passing
- AI powered tool finds decade old Apache ActiveMQ Classic RCE flawInfosecurity · first in our coverage · mentions it in passing