Non notée
CVE-2020-11998 A regression has been introduced in the commit preventing JMX re-bind
Description
A regression has been introduced in the commit preventing JMX re-bind. By passing an empty environment map to RMIConnectorServer, instead of the map that contains the authentication credentials, it leaves ActiveMQ open to the following attack: https://docs.oracle.com/javase/8/docs/technotes/guides/management/agent.html "A remote client could create a javax.management.loading.MLet MBean and use it to create new MBeans from arbitrary URLs, at least if there is no security manager. In other words, a rogue remote client could make your Java application execute arbitrary code." Mitigation: Upgrade to Apache ActiveMQ 5.15.13
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Apache ActiveMQ | Versions non publiées |
Autres CVE de Apache ActiveMQ
Les 4 CVE de Apache ActiveMQ →
CVE-2020-13947
An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console…
Non notée
CVE-2020-13920
Apache ActiveMQ uses LocateRegistry.createRegistry() to create the JMX RMI registry and binds the server to the "jmxrmi"…
Non notée
CVE-2020-1941
In Apache ActiveMQ 5.0.0 to 5.15.11, the webconsole admin GUI is open to XSS, in the view that lists the contents of a…
Non notée