CVE-2021-26118 – org.apache.activemq:artemis-openwire-protocol

Package

Manager: maven
Name: org.apache.activemq:artemis-openwire-protocol
Vulnerable Version: >=0 <2.16.0

Severity

Level: High

CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

EPSS: 0.0101 pctl0.7624

Details

Apache ActiveMQ Artemis vulnerable to Improper Access Control While investigating ARTEMIS-2964 it was found that the creation of advisory messages in the OpenWire protocol head of Apache ActiveMQ Artemis 2.15.0 bypassed policy based access control for the entire session. Production of advisory messages was not subject to access control in error.

Metadata

Created: 2021-06-16T17:39:05Z
Modified: 2022-08-10T23:55:48Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/06/GHSA-q7fr-vqhq-v5xr/GHSA-q7fr-vqhq-v5xr.json
CWE IDs: ["CWE-284", "CWE-287"]
Alternative ID: GHSA-q7fr-vqhq-v5xr
Finding: F039
Auto approve: 1