GHSA-jvpp-hxjj-5ccc

ghsaUSosv

Improper Input Validation and Missing Authentication for Critical Function in Apache ActiveMQ

view advisory published 2019-08-01Licence: CC-BY-4.0

It was found that the Apache ActiveMQ client before 5.14.5 exposed a remote shutdown command in the ActiveMQConnection class. An attacker logged into a compromised broker could use this flaw to achieve denial of service on a connected client.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2015-7559US	low2.7OT elevated	1.97% (80th)	—	2019-08-01
It was found that the Apache ActiveMQ client before 5.14.5 exposed a remote shutdown command in the ActiveMQConnection class. An attacker logged into a compromised broker could use…

references

External citations — patches, advisories, analysis.

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-7559WEB
https://github.com/apache/activemqPACKAGE
https://github.com/apache/activemq/commit/b8fc78ec6c367cbe2a40a674eaec64ac3d7d1ecWEB
https://issues.apache.org/jira/browse/AMQ-6470WEB
https://nvd.nist.gov/vuln/detail/CVE-2015-7559ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan