GHSA-p358-58jj-hp65

Improper Authentication in Apache ActiveMQ

Source: GitHub Advisory Database (reviewed) Moderate CVE-2013-3060

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.apache.activemq:activemq-client	< 5.8.0	5.8.0

Details

As written in the advisory (Markdown source, shown as plain text).

The web console in Apache ActiveMQ before 5.8.0 does not require authentication, which allows remote attackers to obtain sensitive information or cause a denial of service via HTTP requests.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2013-3060 advisory
https://github.com/apache/activemq/commit/22bc55b9487df98a3c3cb04f99f4618fcba364fe web
https://github.com/apache/activemq/commit/437ea2f6e58d18837ae0e68dcd2fdadc1fff3723 web
https://github.com/apache/activemq/commit/ced33d2551a040813cb40bd6d36fdd322034fa73 web
https://fisheye6.atlassian.com/changelog/activemq?cs=1404998 web
https://github.com/apache/activemq package
https://issues.apache.org/jira/browse/AMQ-4124 web
https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12311210&version=12323282 web
http://activemq.2283324.n4.nabble.com/DISCUSS-ActiveMQ-out-of-the-box-Should-not-include-the-demos-tc4658044.html web
http://activemq.apache.org/activemq-580-release.html web
http://rhn.redhat.com/errata/RHSA-2013-1029.html web
http://rhn.redhat.com/errata/RHSA-2013-1221.html web