Overview 7 matches · 1 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 1 EPSS ≥ 0.5
Protected by Waratek
1
14.3%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
6
85.7%
Outside Waratek scope
0
0.0%
Not applicable
0
0.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
1
14.3%
partly blocked
0
0.0%
not blocked
6
85.7%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
0
0.0%
Proof of concept only
0
0.0%
Forecast only
1
14.3%
No public exploit
6
85.7%
split by
peak 2 / year
20102
No exploit published2
Medium1
Low1
not blocked2
No public exploit2
20110
20120
20130
20140
20150
20160
20170
20181
No exploit published1
Low1
not blocked1
No public exploit1
20190
20202
Protected by Waratek1
No exploit published1
Critical1
Medium1
blocked by ARMR today1
not blocked1
No public exploit2
20212
No exploit published2
High1
Medium1
not blocked2
Forecast only1
No public exploit1
201020112012201320142015201620172018201920202021
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2020-13947 | Medium | 2021-02-08 | No exploit published | Forecast only | An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the message.jsp page of Apache ActiveMQ versions 5.15.12 through 5.16.0. |
| CVE-2021-26117 | High | 2021-01-27 | No exploit published | No public exploit | The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server. In this case, for Apache ActiveMQ Artemis prior to version 2.16.0 and Apache ActiveMQ prior to versions 5.16.1 and 5.15.14, the anonymous context is used to verify a valid users password in error, resulting in no check on the password. |
| CVE-2020-13920 | Medium | 2020-09-10 | No exploit published | No public exploit | Apache ActiveMQ uses LocateRegistry.createRegistry() to create the JMX RMI registry and binds the server to the "jmxrmi" entry. It is possible to connect to the registry without authentication and call the rebind method to rebind jmxrmi to something else. If an attacker creates another server to proxy the original, and bound that, he effectively becomes a man in the middle and is able to intercept the credentials when an user connects. Upgrade to Apache ActiveMQ 5.15.12. |
| CVE-2020-11998 | Critical | 2020-09-10 | Protected by Waratek | No public exploit | A regression has been introduced in the commit preventing JMX re-bind. By passing an empty environment map to RMIConnectorServer, instead of the map that contains the authentication credentials, it leaves ActiveMQ open to the following attack: https://docs.oracle.com/javase/8/docs/technotes/guides/management/agent.html "A remote client could create a javax.management.loading.MLet MBean and use it to create new MBeans from arbitrary URLs, at least if there is no security manager. In other words, a rogue remote client could make your Java application execute arbitrary code." Mitigation: Upgrade to Apache ActiveMQ 5.15.13 |
| CVE-2017-15709 | Low | 2018-02-13 | No exploit published | No public exploit | When using the OpenWire protocol in ActiveMQ versions 5.14.0 to 5.15.2 it was found that certain system details (such as the OS and kernel version) are exposed as plain text. |
| CVE-2010-1244 | Medium | 2010-04-05 | No exploit published | No public exploit | Cross-site request forgery (CSRF) vulnerability in createDestination.action in Apache ActiveMQ before 5.3.1 allows remote attackers to hijack the authentication of unspecified victims for requests that create queues via the JMSDestination parameter in a queue action. |
| CVE-2010-0684 | Low | 2010-04-05 | No exploit published | No public exploit | Cross-site scripting (XSS) vulnerability in createDestination.action in Apache ActiveMQ before 5.3.1 allows remote authenticated users to inject arbitrary web script or HTML via the JMSDestination parameter in a queue action. |