CVE-2021-26118: While investigating ARTEMIS-2964 it was found that the creation of advisory messages in the OpenWire protocol head of Apache ActiveMQ Artemis 2.15.0 bypassed…

high7.5CVSS 3.1

AVNACLPRNUINSUCNIHAN

While investigating ARTEMIS-2964 it was found that the creation of advisory messages in the OpenWire protocol head of Apache ActiveMQ Artemis 2.15.0 bypassed policy based access control for the entire session. Production of advisory messages was not subject to access control in error.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
apache	activemq_artemis	—	—
apache_software_foundation	apache_activemq_artemis	>= unspecified < 2.16.0	2.16.0

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

osv7.5HIGH