Staging Environment: Content and features may be unstable or change without notice.
Advisory details: github_osv / GHSA-p358-58jj-hp65
Advisory ID github_osv/GHSA-p358-58jj-hp65
Aliases CVE-2013-3060
Summary Improper Authentication in Apache ActiveMQ The web console in Apache ActiveMQ before 5.8.0 does not require authentication, which allows remote attackers to obtain sensitive information or cause a denial of service via HTTP requests.
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (1)
CWE-287 Improper Authentication
System Score Found at
generic_textual MODERATE
Reference id Reference type URL
http://activemq.2283324.n4.nabble.com/DISCUSS-ActiveMQ-out-of-the-box-Should-not-include-the-demos-tc4658044.html
http://activemq.apache.org/activemq-580-release.html
https://fisheye6.atlassian.com/changelog/activemq?cs=1404998
https://github.com/apache/activemq
https://github.com/apache/activemq/commit/22bc55b9487df98a3c3cb04f99f4618fcba364fe
https://github.com/apache/activemq/commit/437ea2f6e58d18837ae0e68dcd2fdadc1fff3723
https://github.com/apache/activemq/commit/ced33d2551a040813cb40bd6d36fdd322034fa73
https://issues.apache.org/jira/browse/AMQ-4124
https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12311210&version=12323282
CVE-2013-3060 https://nvd.nist.gov/vuln/detail/CVE-2013-3060
RHSA-2013-1029.html http://rhn.redhat.com/errata/RHSA-2013-1029.html
RHSA-2013-1221.html http://rhn.redhat.com/errata/RHSA-2013-1221.html
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
There are no known vectors.

There are no SSVC decisions available.