GitHub Advisoryadvisory · Maven
GHSA-r7mv-mv7m-pjw3 hornetq vulnerable to file overwrite, sensitive information disclosure
HIGH
Official page ↗
- Aliases
- CVE-2024-51127
- Ecosystem
- Maven
- Packages
- org.hornetq:hornetq-core-client
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- Weaknesses
- CWE-200
- Reviewed
- 2024-11-04
Affected packages
• Maven org.hornetq:hornetq-core-client: <= 2.4.9 (no fix yet)
Description
An issue in the `createTempFile` method of hornetq v2.4.9 allows attackers to arbitrarily overwrite files or access sensitive information.
Related
Alias · CVE (1)
- CVE-2024-51127 An issue in the createTempFile method of hornetq v2.4.9 allows attackers to arbitrarily overwrite files or access sensitive information. vulnerability
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-51127 advisory
- https://github.com/JAckLosingHeart/CWE-378/blob/main/CVE-2024-51127.md web
- https://github.com/darranl/hornetq package
- https://github.com/hornetq/hornetq/blob/HornetQ_2_4_9_Final/hornetq-core-client/src/main/java/org/hornetq/core/client/impl/ClientConsumerImpl.java#L665C35-L665C49 web
- http://hornetq.com web