GitHub Advisoryadvisory · Maven

GHSA-7qm4-p377-fr2r ActiveMQ's OpenWire protocol exposes certain system details as plain text

LOW Published 2022-05-13 Modified 2022-11-22 Official page ↗
Aliases
CVE-2017-15709
Ecosystem
Maven
Packages
org.apache.activemq:activemq-openwire-generator, org.apache.activemq:activemq-parent
Severity
Low
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-200
Reviewed
2022-11-22

Affected packages

• Maven org.apache.activemq:activemq-openwire-generator: >= 5.14.0, < 5.15.3 → fixed in 5.15.3 • Maven org.apache.activemq:activemq-parent: >= 5.15.0, < 5.15.3 → fixed in 5.15.3 • Maven org.apache.activemq:activemq-parent: >= 5.14.0, < 5.14.6 → fixed in 5.14.6

Description

When using the OpenWire protocol in ActiveMQ versions 5.14.0 to 5.15.2 it was found that certain system details (such as the OS and kernel version) are exposed as plain text.

Related

Alias · CVE (1)

  • CVE-2017-15709 When using the OpenWire protocol in ActiveMQ versions 5.14.0 to 5.15.2 it was found that certain system details (such as the OS and kernel… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References