⚠ Actively exploited
Added to CISA KEV on 2022-02-10. Federal agencies required to patch by 2022-08-10. Required action: Apply updates per vendor instructions..

CVE-2016-3088

CWE-434 — Unrestricted File UploadCWE-20 — Improper Input ValidationCWE-22 — Path Traversal15 documents12 sources
Severity
9.8CRITICAL
EPSS
94.3%
top 0.06%
CISA KEV
KEV
Added 2022-02-10
Due 2022-08-10
Exploit
Exploited in wild
Active exploitation observed
Affected products
1
Apache Activemq
Timeline
PublishedJun 1
KEV addedFeb 10
Latest updateMay 14
KEV dueAug 10
CISA Required Action: Apply updates per vendor instructions.

Description

The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages3 packages

▶NVDapache/activemq5.0.0 — 5.14.0
▶Mavenorg.apache.activemq:activemq-client5.0.0 — 5.14.0
▶Debianactivemq< 5.14.0+dfsg-1+2

Patches

Patch: lists.apache.org ↗Patch: lists.apache.org ↗

🔴Vulnerability Details

5
GHSA
Improper Input Validation in Apache ActiveMQ↗2022-05-14
▶
OSV
Improper Input Validation in Apache ActiveMQ↗2022-05-14
▶
CVEList
CVE-2016-3088: The Fileserver web application in Apache ActiveMQ 5↗2016-06-01
▶
OSV
CVE-2016-3088: The Fileserver web application in Apache ActiveMQ 5↗2016-06-01
▶
VulnCheck
Apache ActiveMQ Improper Input Validation Vulnerability↗2016
▶

💥Exploits & PoCs

3
Exploit-DB
ActiveMQ < 5.14.0 - Web Shell Upload (Metasploit)↗2017-06-29
▶
Exploit-DB
Apache ActiveMQ 5.11.1/5.13.2 - Directory Traversal / Command Execution↗2015-08-17
▶
Nuclei
Apache ActiveMQ Fileserver - Arbitrary File Write
▶

🔍Detection Rules

1
Suricata
ET WEB_SPECIFIC_APPS Apache ActiveMQ File Upload RCE (CVE-2016-3088)↗2018-05-10
▶

📋Vendor Advisories

3
CISA
Apache ActiveMQ Improper Input Validation Vulnerability↗2022-02-10
▶
Red Hat
activemq: Fileserver web application vulnerability allowing RCE↗2016-05-24
▶
Debian
CVE-2016-3088: activemq - The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remot...↗2016
▶

💬Community

2
Bugzilla
CVE-2016-3088 activemq: Fileserver web application vulnerability allowing RCE [fedora-all]↗2016-05-24
▶
Bugzilla
CVE-2016-3088 activemq: Fileserver web application vulnerability allowing RCE↗2016-05-24
▶
CVE-2016-3088 (CRITICAL CVSS 9.8) | The Fileserver web application in A | cvebase.io