Apache Software Foundation ActiveMQ Artemis 2.8.1

CPE Details

Apache Software Foundation ActiveMQ Artemis 2.8.1
apache
activemq_artemis
2.8.1
2019-07-10
13h10 +00:00
2019-07-10
13h10 +00:00
CPE NVD
Alerte pour un CPE
Stay informed of any changes for a specific CPE.
Notifications manage

CPE Name: cpe:2.3:a:apache:activemq_artemis:2.8.1:*:*:*:*:*:*:*

Informations

Vendor

apache

Product

activemq_artemis

Version

2.8.1

Related CVE

Open and find in CVE List

CVE ID Published Description Score Severity
CVE-2023-50780 2024-10-14 16h03 +00:00 Apache ActiveMQ Artemis allows access to diagnostic information and controls through MBeans, which are also exposed through the authenticated Jolokia endpoint. Before version 2.29.0, this also included the Log4J2 MBean. This MBean is not meant for exposure to non-administrative users. This could eventually allow an authenticated attacker to write arbitrary files to the filesystem and indirectly achieve RCE. Users are recommended to upgrade to version 2.29.0 or later, which fixes the issue.
8.8
High
CVE-2021-4040 2022-08-24 13h13 +00:00 A flaw was found in AMQ Broker. This issue can cause a partial interruption to the availability of AMQ Broker via an Out of memory (OOM) condition. This flaw allows an attacker to partially disrupt availability to the broker through a sustained attack of maliciously crafted messages. The highest threat from this vulnerability is system availability.
5.3
Medium
CVE-2022-35278 2022-08-22 22h00 +00:00 In Apache ActiveMQ Artemis prior to 2.24.0, an attacker could show malicious content and/or redirect users to a malicious URL in the web console by using HTML in the name of an address or queue.
6.1
Medium
CVE-2022-23913 2022-02-04 21h33 +00:00 In Apache ActiveMQ Artemis prior to 2.20.0 or 2.19.1, an attacker could partially disrupt availability (DoS) through uncontrolled resource consumption of memory.
7.5
High
CVE-2021-26117 2021-01-26 23h00 +00:00 The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server. In this case, for Apache ActiveMQ Artemis prior to version 2.16.0 and Apache ActiveMQ prior to versions 5.16.1 and 5.15.14, the anonymous context is used to verify a valid users password in error, resulting in no check on the password.
7.5
High
CVE-2020-13932 2020-07-20 19h08 +00:00 In Apache ActiveMQ Artemis 2.5.0 to 2.13.0, a specially crafted MQTT packet which has an XSS payload as client-id or topic name can exploit this vulnerability. The XSS payload is being injected into the admin console's browser. The XSS payload is triggered in the diagram plugin; queue node and the info section.
6.1
Medium
CVE-2020-10727 2020-06-26 13h38 +00:00 A flaw was found in ActiveMQ Artemis management API from version 2.7.0 up until 2.12.0, where a user inadvertently stores passwords in plaintext in the Artemis shadow file (etc/artemis-users.properties file) when executing the `resetUsers` operation. A local attacker can use this flaw to read the contents of the Artemis shadow file.
5.5
Medium