logo

Database

Insecure file upload In org.apache.activemq:activemq-client

Description

Improper Input Validation in Apache ActiveMQ The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2016-30882. NVD-2016-30883. OSV-2016-30884. OSV-DEBIAN-2016-30885. GCVE-2016-30886. SECURITY-TRACKER-CVE-2016-3088

References

1. https://github.com/apache/activemq/commit/3dd86d04e8b90ba309819317d19e7260d414d9e72. https://issues.apache.org/jira/browse/AMQ-62763. https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apache.org%3E4. https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2@%3Ccommits.activemq.apache.org%3E5. https://lists.apache.org/thread.html/f956ea38e4da2e2c1e7131e6f91e41754852f5a4861d1a14ca5ca78a%40%3Cusers.activemq.apache.org%3E6. https://lists.apache.org/thread.html/f956ea38e4da2e2c1e7131e6f91e41754852f5a4861d1a14ca5ca78a@%3Cusers.activemq.apache.org%3E7. https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E8. https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c@%3Cannounce.apache.org%3E9. https://stackoverflow.com/questions/67140241/configuring-activemq-webconsole-to-redirect-http-to-https10. https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-308811. https://www.exploit-db.com/exploits/4228312. http://activemq.apache.org/security-advisories.data/CVE-2016-3088-announcement.txt13. http://rhn.redhat.com/errata/RHSA-2016-2036.html14. http://www.securitytracker.com/id/103595115. http://www.zerodayinitiative.com/advisories/ZDI-16-35616. http://www.zerodayinitiative.com/advisories/ZDI-16-35717. https://www.exploit-db.com/exploits/4085718. https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-3088.yaml19. https://github.com/Ma1Dong/ActiveMQ_putshell-CVE-2016-308820. https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/apache_activemq_upload_jsp.rb

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.