CVE-2016-3088 Improper Input Validation in Apache ActiveMQ
CriticalCVSS 9.8
EPSS 98.4%
CISA KEV
added 2022-02-10 · due 2022-08-10
Exploited in the wild
Framework module
Public exploit
PoC
- Published
- Updated
- Exploit status
- Exploited in the wild (confirmed)
Description
The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.
CISA Known Exploited Vulnerability
- Date added
- 2022-02-10
- Due date (FCEB)
- 2022-08-10
- Ransomware use
- Unknown
Required action
Apply updates per vendor instructions.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.activemq/activemq-client(Maven) | >= 5.0.0, < 5.14.0 | 5.14.0 |
| org.apache.activemq/activemq-client(Maven) | = 5.10.0 | No fix listed |
| org.apache.activemq/activemq-client(Maven) | = 5.10.1 | No fix listed |
| org.apache.activemq/activemq-client(Maven) | = 5.10.2 | No fix listed |
| org.apache.activemq/activemq-client(Maven) | = 5.11.0 | No fix listed |
| org.apache.activemq/activemq-client(Maven) | = 5.11.1 | No fix listed |
| org.apache.activemq/activemq-client(Maven) | = 5.11.2 | No fix listed |
| org.apache.activemq/activemq-client(Maven) | = 5.11.3 | No fix listed |
| org.apache.activemq/activemq-client(Maven) | = 5.11.4 | No fix listed |
| org.apache.activemq/activemq-client(Maven) | = 5.12.0 | No fix listed |
| org.apache.activemq/activemq-client(Maven) | = 5.12.1 | No fix listed |
| org.apache.activemq/activemq-client(Maven) | = 5.12.2 | No fix listed |
| org.apache.activemq/activemq-client(Maven) | = 5.12.3 | No fix listed |
| org.apache.activemq/activemq-client(Maven) | = 5.13.0 | No fix listed |
| org.apache.activemq/activemq-client(Maven) | = 5.13.1 | No fix listed |
| org.apache.activemq/activemq-client(Maven) | = 5.13.2 | No fix listed |
| org.apache.activemq/activemq-client(Maven) | = 5.13.3 | No fix listed |
| org.apache.activemq/activemq-client(Maven) | = 5.13.4 | No fix listed |
| org.apache.activemq/activemq-client(Maven) | = 5.13.5 | No fix listed |
| org.apache.activemq/activemq-client(Maven) | = 5.8.0 | No fix listed |
| org.apache.activemq/activemq-client(Maven) | = 5.9.0 | No fix listed |
| org.apache.activemq/activemq-client(Maven) | = 5.9.1 | No fix listed |
| debian/activemq(Debian:12) | < 5.14.0+dfsg-1 | 5.14.0+dfsg-1 |
| debian/activemq(Debian:13) | < 5.14.0+dfsg-1 | 5.14.0+dfsg-1 |
| apache activemq | >= 5.0.0, < 5.14.0 | 5.14.0 |
References
- Debian Security Tracker CVE-2016-3088 vendor-advisory
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- issues.apache.org
- [activemq-commits] 20190327 svn commit: r1042639 - in /websites/production/activemq/content/activemq-website: ./ projects/artemis/download/ projects/classic/download/ projects/cms/download/ security-advisories.data/ mailing-list patch
- lists.apache.org
- [activemq-users] 20190703 Re: ActiveMQ cve vulnerabilities seen in latest version issue-tracking mailing-list
- lists.apache.org
- [announce] 20200131 Apache Software Foundation Security Report: 2019 mailing-list vendor-advisory
- lists.apache.org
- stackoverflow.com
- www.cisa.gov government-resource us-government-resource
- 42283 exploit third-party-advisory vdb-entry
- activemq.apache.org vendor-advisory
- RHSA-2016:2036 third-party-advisory vendor-advisory
- 1035951 broken-link third-party-advisory vdb-entry
- www.zerodayinitiative.com third-party-advisory vdb-entry
- www.zerodayinitiative.com third-party-advisory vdb-entry
- github.com