CVE-2024-32114

CWE-11888 documents7 sources
Severity
8.8HIGH
EPSS
2.0%
top 16.22%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache ActivemqApache Software Foundation Apache Activemq
Timeline
PublishedMay 2
Latest updateOct 15

Description

In Apache ActiveMQ 6.x, the default configuration doesn't secure the API web context (where the Jolokia JMX REST API and the Message REST API are located). It means that anyone can use these layers without any required authentication. Potentially, anyone can interact with the broker (using Jolokia JMX REST API) and/or produce/consume messages or purge/delete destinations (using the Message REST API). To mitigate, users can update the default conf/jetty.xml configuration file to add authenticati…

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:HExploitability: 2.1 | Impact: 5.8

Affected Packages3 packages

▶NVDapache/activemq6.0.0 — 6.1.2

🔴Vulnerability Details

3
GHSA
Apache ActiveMQ's default configuration doesn't secure the API web context↗2024-05-02
▶
CVEList
Apache ActiveMQ: Jolokia and REST API were not secured with default configuration↗2024-05-02
▶
OSV
Apache ActiveMQ's default configuration doesn't secure the API web context↗2024-05-02
▶

📋Vendor Advisories

4
Oracle
Oracle Oracle Financial Services Applications Risk Matrix: Authentication (Apache ActiveMQ) — CVE-2024-32114↗2024-10-15
▶
Oracle
Oracle Oracle Financial Services Applications Risk Matrix: Infrastructure (Apache ActiveMQ) — CVE-2024-32114↗2024-07-15
▶
Red Hat
activemq-broker: Jolokia and REST API were not secured with default configuration↗2024-05-01
▶
Debian
CVE-2024-32114: activemq - In Apache ActiveMQ 6.x, the default configuration doesn't secure the API web con...↗2024
▶