CVE-2015-5254

CWE-20 — Improper Input ValidationCWE-502 — Deserialization of Untrusted Data11 documents8 sources
Severity
9.8CRITICAL
EPSS
80.4%
top 0.88%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Apache Software Foundation Apache NifiApache ActivemqFedoraproject Fedora+1 more
Timeline
PublishedJan 8
Latest updateMay 14

Description

Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages5 packages

▶Mavenorg.apache.activemq:activemq-client5.0.0 — 5.11.3+1
▶NVDapache/activemq24 versions+23
▶Debianactivemq< 5.13.2+dfsg-1+2

Also affects: Fedora 22, 23

🔴Vulnerability Details

5
GHSA
Apache NiFi JMS Deserialization issue↗2022-05-14
▶
OSV
Improper Input Validation in Apache ActiveMQ↗2022-05-13
▶
GHSA
Improper Input Validation in Apache ActiveMQ↗2022-05-13
▶
OSV
CVE-2015-5254: Apache ActiveMQ 5↗2016-01-08
▶
CVEList
CVE-2015-5254: Apache ActiveMQ 5↗2016-01-08
▶

📋Vendor Advisories

3
Red Hat
ObjectMessage: unsafe deserialization↗2015-12-08
▶
Debian
CVE-2015-5254: activemq - Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be seri...↗2015
▶
Apache
Apache nifi: CVE-2018-1310↗
▶

💬Community

2
Bugzilla
CVE-2015-5254 JMS ObjectMessage: unsafe deserialization↗2015-12-14
▶
Bugzilla
CVE-2015-5254 activemq: unsafe deserialization [fedora-all]↗2015-12-14
▶
CVE-2015-5254 (CRITICAL CVSS 9.8) | Apache ActiveMQ 5.x before 5.13.0 d | cvebase.io