logo

Database

Lack of data validation - Path Traversal In org.apache.activemq:activemq-client

Description

Improper Limitation of a Pathname to a Restricted Directory in Apache ActiveMQ Directory traversal vulnerability in the fileserver upload/download functionality for blob messages in Apache ActiveMQ 5.x before 5.11.2 for Windows allows remote attackers to create JSP files in arbitrary directories via unspecified vectors.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2015-18302. NVD-2015-18303. OSV-2015-18304. GCVE-2015-1830

References

1. https://github.com/apache/activemq/commit/729c4731574ffffaf58ebefdbaeb3bd19ed1c7b72. https://github.com/apache/activemq/commit/9fd5cb7dfe0fcc431f99d5e14206e0090e72f36b3. https://github.com/apache/activemq4. https://issues.apache.org/jira/browse/AMQ-57545. https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apache.org%3E6. https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2@%3Ccommits.activemq.apache.org%3E7. http://activemq.apache.org/security-advisories.data/CVE-2015-1830-announcement.txt8. http://packetstormsecurity.com/files/156643/Apache-ActiveMQ-5.11.1-Directory-Traversal-Shell-Upload.html9. http://www.securityfocus.com/bid/7645210. http://www.securitytracker.com/id/103331511. http://www.zerodayinitiative.com/advisories/ZDI-15-40712. https://www.exploit-db.com/exploits/4085713. https://www.exploit-db.com/exploits/4818114. https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/apache_activemq_traversal_upload.rb

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.