Summary
Ein Angreifer kann mehrere Schwachstellen in Apache ActiveMQ ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen, Informationen offenzulegen, seine Rechte zu erweitern, Daten zu manipulieren und Code auszuführen.
Product
Apache ActiveMQ ist ein Open Source Message Broker, der den Transport von Nachrichten zwischen verschiedenen Programmen bewerkstelligt.
Vulnerabilities 6
-
High 8.8
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Jolokia `addNetworkConnector` Discovery Wrapper Bypass
Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. Non-parenthesized discovery wrappers such as `masterslave:vm://...,...` and `static:vm://...` i…
-
High 8.8
Apache ActiveMQ: Authenticated low-privilege Web users retain Jolokia broker-management capability by default
Incorrect Default Permissions vulnerability in Apache ActiveMQ. This issue affects Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6. The default Jolokia authorization settings granted non-admin (low-privilege) web-login accounts access to Jolokia opera…
-
High 8.1CVE-2026-42588 Public exploit
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Remote Code Execution via Jolokia addNetworkConnector
Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console…
-
Medium 6.1
Apache ActiveMQ, Apache ActiveMQ Web: HTTP Response Header Injection via JMS Message Properties
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache ActiveMQ, Apache ActiveMQ Web. The MessageServlet in the ActiveMQ web console API copies every JMS message property into an HTTP response header witho…
-
Medium 5.9
Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: Durable Subscription Disclosure via Crafted BrokerInfo (OpenWire)
Exposure of Sensitive Information Through Metadata vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All. Brokers that are configured with a network connector with syncDurableSubs set to true, are vulnerable to an unauthenticated attac…
-
Medium 4.3
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incomplete authorization during destination removal
Incomplete authorization by Apache ActiveMQ server before versions v6.2.6 and v5.19.7 allows authenticated connections to remove existing destinations with proper permissions. This issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; …
Revision history
-
#3
Neue Updates von Red Hat aufgenommen
-
#2
Link zu CVE-2026-46605 korrigiert
-
#1
Initiale Fassung
References
-
Apache ActiveMQ Security Advisory vom 2026-05-31
https://activemq.apache.org/security-advisories.data/CVE-2026-42253-announcement.txt
-
Apache ActiveMQ Security Advisory vom 2026-05-31
https://activemq.apache.org/security-advisories.data/CVE-2026-42588-announcement.txt
-
Apache ActiveMQ Security Advisory vom 2026-05-31
https://activemq.apache.org/security-advisories.data/CVE-2026-45505-announcement.txt
-
Apache ActiveMQ Security Advisory vom 2026-05-31
https://activemq.apache.org/security-advisories.data/CVE-2026-46605-announcement.txt
-
Apache ActiveMQ Security Advisory vom 2026-05-31
https://activemq.apache.org/security-advisories.data/CVE-2026-49157-announcement.txt
-
Apache ActiveMQ Security Advisory vom 2026-05-31
https://activemq.apache.org/security-advisories.data/CVE-2026-49270-announcement.txt
-
Apache ActiveMQ Security Advisory vom 2026-05-31
https://activemq.apache.org/security-advisories.data
-
Red Hat Security Advisory RHSA-2026:66545 vom 2026-09-11
https://access.redhat.com/errata/RHSA-2026:66545