GitHub Advisoryadvisory · Maven

GHSA-rxqh-fc23-gxp2 Improper Input Validation in Apache ActiveMQ

CRITICAL Published 2022-05-14 Modified 2025-10-22 Official page ↗
Aliases
CVE-2016-3088
Ecosystem
Maven
Packages
org.apache.activemq:activemq-client
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
Weaknesses
CWE-20, CWE-434
Reviewed
2022-07-06

Affected packages

• Maven org.apache.activemq:activemq-client: >= 5.0.0, < 5.14.0 → fixed in 5.14.0

Description

The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.

Related

Alias · CVE (1)

  • CVE-2016-3088 The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an… vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-434 Unrestricted Upload of File with Dangerous Type weakness

References