Описание
Incorrect Default Permissions vulnerability in Apache ActiveMQ.
This issue affects Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6.
The default Jolokia authorization settings granted non-admin (low-privilege) web-login accounts access to Jolokia operations which allowed executing broker management operations meant for admins such as addQueue and removeQueue.
Users are recommended to upgrade to version 6.2.6 or 5.19.7, which fixes the issue.
A flaw was found in Apache ActiveMQ. The default authorization settings for Jolokia, a management interface, incorrectly allowed non-administrative web-login accounts to access and execute critical broker management operations. This could enable a low-privilege attacker to perform actions typically reserved for administrators, such as adding or removing queues, leading to unauthorized control over the message broker.
Отчет
Red Hat products ship Apache ActiveMQ Classic components as transitive dependencies. The vulnerability is in the default Jolokia authorization settings on the Classic ActiveMQ web console, allowing non-admin web users to execute admin-only broker management operations via JMX-over-HTTP. The Classic web console with Jolokia is not deployed in any Red Hat product. Red Hat AMQ Broker is based on Apache ActiveMQ Artemis with its own management interface.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat AMQ Broker 7 | activemq-artemis-native | Fix deferred | ||
| Red Hat AMQ Broker 7 | activemq-client | Fix deferred | ||
| Red Hat AMQ Broker 7 | activemq-openwire-legacy | Fix deferred | ||
| Red Hat AMQ Broker 7 | apache-artemis | Fix deferred | ||
| Red Hat AMQ Broker 7 | artemis-amqp-protocol | Fix deferred | ||
| Red Hat AMQ Broker 7 | artemis-boot | Fix deferred | ||
| Red Hat AMQ Broker 7 | artemis-cli | Fix deferred | ||
| Red Hat AMQ Broker 7 | artemis-commons | Fix deferred | ||
| Red Hat AMQ Broker 7 | artemis-console | Fix deferred | ||
| Red Hat AMQ Broker 7 | artemis-console-war | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
8.1 High
CVSS3
Связанные уязвимости
Incorrect Default Permissions vulnerability in Apache ActiveMQ. This issue affects Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6. The default Jolokia authorization settings granted non-admin (low-privilege) web-login accounts access to Jolokia operations which allowed executing broker management operations meant for admins such as addQueue and removeQueue. Users are recommended to upgrade to version 6.2.6 or 5.19.7, which fixes the issue.
Incorrect Default Permissions vulnerability in Apache ActiveMQ. This issue affects Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6. The default Jolokia authorization settings granted non-admin (low-privilege) web-login accounts access to Jolokia operations which allowed executing broker management operations meant for admins such as addQueue and removeQueue. Users are recommended to upgrade to version 6.2.6 or 5.19.7, which fixes the issue.
Incorrect Default Permissions vulnerability in Apache ActiveMQ. This ...
Apache ActiveMQ has an Incorrect Default Permissions vulnerability
EPSS
8.1 High
CVSS3