GHSA-gj5m-m88j-v7c3 BIT-activemq-2024-32114 CVE-2024-32114
Apache ActiveMQ's default configuration doesn't secure the API web context
- Severity
- 8.8 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 7.15%
- Chance of exploitation in the next 30 days. Higher than 94.27% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-1188 Initialization of a Resource with an Insecure Default
- Fix
6.1.2- Upgrade org.apache.activemq:apache-activemq to this version or later
Description
In Apache ActiveMQ 6.x, the default configuration doesn't secure the API web context (where the Jolokia JMX REST API and the Message REST API are located). It means that anyone can use these layers without any required authentication. Potentially, anyone can interact with the broker (using Jolokia JMX REST API) and/or produce/consume messages or purge/delete destinations (using the Message REST API).
To mitigate, users can update the default conf/jetty.xml configuration file to add authentication requirement: <bean id="securityConstraintMapping" class="org.eclipse.jetty.security.ConstraintMapping"> <property name="constraint" ref="securityConstraint" /> <property name="pathSpec" value="/" /> </bean>
Or we encourage users to upgrade to Apache ActiveMQ 6.1.2 where the default configuration has been updated with authentication by default.
Affected versions
Maven
| Package | Vulnerable | Fixed in |
|---|---|---|
| org.apache.activemq:apache-activemq | >= 6.0.0, < 6.1.2 |
6.1.2 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
org.apache.activemq:apache-activemq Maven → 6.1.2
- maven
<dependency><groupId>org.apache.activemq</groupId><artifactId>apache-activemq</artifactId><version>6.1.2</version></dependency>- gradle
implementation("org.apache.activemq:apache-activemq:6.1.2")
Severity breakdown
CVSS 3.1 8.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- Required
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weakness
CWE-1188: Initialization of a Resource with an Insecure Default
The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-hf52-78x8-6w3w Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All have an Exposure of Sensitive Information Through Metadata vulnerability | Medium | Also affects org.apache.activemq:apache-activemq |
| GHSA-99qx-5qqr-4j95 Apache ActiveMQ has an Incorrect Default Permissions vulnerability | High | Also affects org.apache.activemq:apache-activemq |
| GHSA-cpw7-g3p5-qrfq Apache ActiveMQ server has an incomplete authorization workflow | Medium | Also affects org.apache.activemq:apache-activemq |
| GHSA-v853-w46p-fv2h Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ have a Code Injection issue | High | Also affects org.apache.activemq:apache-activemq |
| GHSA-hg6c-8mvr-jqc9 Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ have a Code Injection issue | High | Also affects org.apache.activemq:apache-activemq |
| GHSA-8wm6-6fqh-phmc Apache ActiveMQ, Apache ActiveMQ Web have a Cross-site Scripting issue | Medium | Also affects org.apache.activemq:apache-activemq |
| GHSA-mr6m-xj7v-3cv3 Apache ActiveMQ Vulnerable to Code Injection | High | Also affects org.apache.activemq:apache-activemq |
| GHSA-2jp3-2923-9h52 Apache ActiveMQ Vulnerable to Cross-site Scripting | Medium | Also affects org.apache.activemq:apache-activemq |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor