GHSA-r7mv-mv7m-pjw3
hornetq vulnerable to file overwrite, sensitive information disclosure
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.hornetq:hornetq-core-client | <= 2.4.9 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
An issue in the `createTempFile` method of hornetq v2.4.9 allows attackers to arbitrarily overwrite files or access sensitive information.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2024-51127
- https://github.com/JAckLosingHeart/CWE-378/blob/main/CVE-2024-51127.md
- https://github.com/darranl/hornetq
- https://github.com/hornetq/hornetq/blob/HornetQ_2_4_9_Final/hornetq-core-client/src/main/java/org/hornetq/core/client/impl/ClientConsumerImp…
- http://hornetq.com