Advisory details:
github_osv / GHSA-rxqh-fc23-gxp2
| Advisory ID | github_osv/GHSA-rxqh-fc23-gxp2 |
| Aliases |
CVE-2016-3088
|
| Summary | Improper Input Validation in Apache ActiveMQ The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request. |
| Status | Published |
| Exploitability | 2.0 |
| Weighted Severity | 8.8 |
| Risk | 10.0 |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| System | Score | Found at |
|---|---|---|
| cvssv3 | 9.8 | https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-rxqh-fc23-gxp2/GHSA-rxqh-fc23-gxp2.json |
| generic_textual | CRITICAL |
| Data source | Exploit-DB |
|---|---|
| Date added | June 29, 2017 |
| Description | ActiveMQ < 5.14.0 - Web Shell Upload (Metasploit) |
| Ransomware campaign use | Known |
| Source publication date | June 29, 2017 |
| Exploit type | remote |
| Platform | java |
| Source update date | June 30, 2017 |
| Source URL | https://github.com/rapid7/metasploit-framework/blob/43d8c4c5e7450d46eba2f18e6e0b6ba70c6dc671/modules/exploits/multi/http/apache_activemq_upload_jsp.rb |
| Data source | Metasploit |
|---|---|
| Description | The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request. |
| Note | Reliability: - unknown-reliability Stability: - unknown-stability SideEffects: - unknown-side-effects |
| Ransomware campaign use | Unknown |
| Source publication date | June 1, 2016 |
| Platform | Java,Linux,Windows |
| Source URL | https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/multi/http/apache_activemq_upload_jsp.rb |
| Data source | KEV |
|---|---|
| Date added | Feb. 10, 2022 |
| Description | The Fileserver web application in Apache ActiveMQ allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request |
| Required action | Apply updates per vendor instructions. |
| Due date | Aug. 10, 2022 |
| Note | https://nvd.nist.gov/vuln/detail/CVE-2016-3088 |
| Ransomware campaign use | Unknown |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
| Attack Vector (AV) | Attack Complexity (AC) | Privileges Required (PR) | User Interaction (UI) | Scope (S) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|---|
network adjacent_network local physical |
low high |
none low high |
none required |
unchanged changed |
high low none |
high low none |
high low none |
Vector: SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-07T13:28:15Z/
Decision: Act
Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2016/3xxx/CVE-2016-3088.json
Source Advisory: vulnrichment/CVE-2016-3088
[{'Exploitation': 'active'},
{'Automatable': 'yes'},
{'Technical Impact': 'total'},
{'Mission Prevalence': 'minimal'},
{'Public Well-being Impact': 'material'},
{'Mission & Well-being': 'medium'}]