CVE-2010-1244 Cross-site request forgery in Apache ActiveMQ
MediumCVSS 6.8
EPSS 1.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site request forgery (CSRF) vulnerability in createDestination.action in Apache ActiveMQ before 5.3.1 allows remote attackers to hijack the authentication of unspecified victims for requests that create queues via the JMSDestination parameter in a queue action.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.activemq/activemq-parent(Maven) | < 5.3.1 | 5.3.1 |
| org.apache.activemq/activemq-parent(Maven) | = 4.1.1 | No fix listed |
| org.apache.activemq/activemq-parent(Maven) | = 4.1.2 | No fix listed |
| org.apache.activemq/activemq-parent(Maven) | = 5.0.0 | No fix listed |
| org.apache.activemq/activemq-parent(Maven) | = 5.1.0 | No fix listed |
| org.apache.activemq/activemq-parent(Maven) | = 5.2.0 | No fix listed |
| org.apache.activemq/activemq-parent(Maven) | = 5.3.0 | No fix listed |
| apache activemq | <= 5.3.0 | No fix listed |
| apache activemq | = 1.1 | No fix listed |
| apache activemq | = 1.2 | No fix listed |
| apache activemq | = 1.3 | No fix listed |
| apache activemq | = 1.4 | No fix listed |
| apache activemq | = 1.5 | No fix listed |
| apache activemq | = 2.0 | No fix listed |
| apache activemq | = 2.1 | No fix listed |
| apache activemq | = 3.0 | No fix listed |
| apache activemq | = 3.1 | No fix listed |
| apache activemq | = 3.2 | No fix listed |
| apache activemq | = 3.2.1 | No fix listed |
| apache activemq | = 3.2.2 | No fix listed |
| apache activemq | = 4.0 | No fix listed |
| apache activemq | = 4.0-m4 | No fix listed |
| apache activemq | = 4.0-rc2 | No fix listed |
| apache activemq | = 4.0.1 | No fix listed |
| apache activemq | = 4.0.2 | No fix listed |
Show 5 more
| Product | Affected versions | Fixed in |
|---|---|---|
| apache activemq | = 4.1.0 | No fix listed |
| apache activemq | = 4.1.1 | No fix listed |
| apache activemq | = 5.0.0 | No fix listed |
| apache activemq | = 5.1.0 | No fix listed |
| apache activemq | = 5.2.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- activemq-web-console-csrf(57398) vdb-entry
- issues.apache.org exploit
- issues.apache.org exploit
- activemq.apache.org patch
- 39223 third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- github.com
- github.com