org.apache.activemq:apache-activemq@5.4.1 vulnerabilities
-
latest version
6.1.0
-
latest non vulnerable version
-
first published
17 years ago
-
latest version published
17 days ago
-
licenses detected
- [4.1.1,)
-
package manager
Direct Vulnerabilities
Known vulnerabilities in the org.apache.activemq:apache-activemq package. This does not include vulnerabilities belonging to this package’s dependencies.
Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.Vulnerability | Vulnerable Version |
---|---|
org.apache.activemq:apache-activemq is a Message Broker and Client implementations. Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the Note: This is only exploitable if the user is authenticated on Jolokia. How to fix Deserialization of Untrusted Data? Upgrade |
[,5.16.6)
[5.17.0,5.17.4)
|
The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request. |
[5.0.0,5.13.3)
|
org.apache.activemq:apache-activemq is a Message Broker and Client implementations. Affected versions of this package are vulnerable to XML External Entity (XXE) Injection. This could allow remote consumers to have unspecified impact via vectors involving an XPath based selector when dequeuing XML messages. How to fix XML External Entity (XXE) Injection? Upgrade |
[5.0.0,5.10.1)
|
org.apache.activemq:apache-activemq is a Message Broker and Client implementations. Affected versions of this package are vulnerable to Directory Traversal in the fileserver upload/download functionality for blob messages. It allows remote attackers to create JSP files in arbitrary directories via unspecified vectors. How to fix Directory Traversal? Upgrade |
[5.0.0,5.11.2)
|
org.apache.activemq:apache-activemq is a Message Broker and Client implementations. Affected versions of this package are vulnerable to Denial of Service (DoS). The default configuration enables a sample web application, which allows remote attackers to cause a denial of service (broker resource consumption) via HTTP requests. How to fix Denial of Service (DoS)? Upgrade |
[,5.8.0)
|