WaratekVRT Sign in
Reset
More filters (2)
Columns
EPSS ≥ 0.5✕Vendor org.apache.activemq✕
Overview 3 matches · 2 protected · 0 exploited · 0 CISA KEV
3matches 2protected66.7% 0exploited0.0% 0CISA KEV0.0%
Protected by Waratek 2 66.7% Rule in development 0 0.0% Mitigation candidate 1 33.3% No exploit published 0 0.0%
Critical 0 0.0% High 1 33.3% Medium 2 66.7% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 2 66.7% partly blocked 0 0.0% not blocked 1 33.3% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 3 100.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 1 / year
Mitigation candidate: 1Protected by Waratek: 2 Medium: 2High: 1 not blocked: 1blocked by ARMR today: 2 Working exploit published: 3
20101 Mitigation candidate1 Medium1 not blocked1 Working exploit published1 20110 20120 20130 20140 20151 Protected by Waratek1 Medium1 blocked by ARMR today1 Working exploit published1 20160 20170 20180 20190 20200 20210 20220 20231 Protected by Waratek1 High1 blocked by ARMR today1 Working exploit published1
2011201320152017201920212023
3 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2022-41678 High 2023-11-28 Protected by Waratek Working exploit published Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution.  In details, in ActiveMQ configurations, jetty allows org.jolokia.http.AgentServlet to handler request to /api/jolokia org.jolokia.http.HttpRequestHandler#handlePostRequest is able to create JmxRequest through JSONObject. And calls to org.jolokia.http.HttpRequestHandler#executeRequest. Into deeper calling stacks, org.jolokia.handler.ExecHandler#doHandleRequest can be invoked through refection. This could lead to RCE through via various mbeans. One example is unrestricted deserialization in jdk.management.jfr.FlightRecorderMXBeanImpl which exists on Java version above 11. 1 Call newRecording. 2 Call setConfiguration. And a webshell data hides in it. 3 Call startRecording. 4 Call copyTo method. The webshell will be written to a .jsp file. The mitigation is to restrict (by default) the actions authorized on Jolokia, or disable Jolokia. A more restrictive Jolokia configuration has been defined in default ActiveMQ distribution. We encourage users to upgrade to ActiveMQ distributions version including updated Jolokia configuration: 5.16.6, 5.17.4, 5.18.0, 6.0.0.
CVE-2015-1830 Medium 2015-08-19 Protected by Waratek Working exploit published Directory traversal vulnerability in the fileserver upload/download functionality for blob messages in Apache ActiveMQ 5.x before 5.11.2 for Windows allows remote attackers to create JSP files in arbitrary directories via unspecified vectors.
CVE-2010-1587 Medium 2010-04-28 Mitigation candidate Working exploit published The Jetty ResourceHandler in Apache ActiveMQ 5.x before 5.3.2 and 5.4.x before 5.4.0 allows remote attackers to read JSP source code via a // (slash slash) initial substring in a URI for (1) admin/index.jsp, (2) admin/queues.jsp, or (3) admin/topics.jsp.