org.apache.activemq/apache-artemis vulnerabilities

Latest org.apache.activemq/apache-artemis CVEs

Newest publication first

1. CVE-2021-26117 ActiveMQ: LDAP-Authentication does not verify passwords on servers with anonymous bind

   Published 2021-01-27

   High·CVSS 7.5 EPSS 11.5%

   The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server. In this case, for Apache ActiveMQ Artemis prior to version 2.16.0 and Apache ActiveMQ prior to versions 5.16.1 and 5.15.14, the anonymous context is used to verify a valid users...

2. CVE-2020-13932 Cross-site Scripting (XSS) in Apache ActiveMQ Artemis

   Published 2020-07-20

   Medium·CVSS 6.1 EPSS 4.3%

   In Apache ActiveMQ Artemis 2.5.0 to 2.13.0, a specially crafted MQTT packet which has an XSS payload as client-id or topic name can exploit this vulnerability. The XSS payload is being injected into the admin console's browser. The XSS payload is triggered in the diagram plugin;...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.