9.8Kritisch
KEV
CVE-2016-3088Apache ActiveMQ Improper Input Validation Vulnerability
Bekannt ausgenutzt — Apache ActiveMQ Improper Input Validation Vulnerability
CISA hat am 10.02.2022 bestätigt, dass diese Schwachstelle in echten Angriffen genutzt wird. Frist für US-Bundesbehörden: 10.08.2022.
Erforderliche Maßnahme: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2016-3088
Beschreibung
The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.
Schwachstellentyp (CWE):
CWE-434
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
Referenzen und Patches
- http://www.zerodayinitiative.com/advisories/ZDI-16-356 Third Party AdvisoryVDB Entry
- 42283 exploitExploitThird Party AdvisoryVDB Entry
- http://www.zerodayinitiative.com/advisories/ZDI-16-357 Third Party AdvisoryVDB Entry
- http://activemq.apache.org/security-advisories.data/CVE-2016-3088-announcement.txt Vendor Advisory
- RHSA-2016:2036 vendor-advisoryThird Party Advisory
- 1035951 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
- [activemq-commits] 20190327 svn commit: r1042639 - in /websites/production/activemq/content/activemq-website: ./ projects/artemis/download/ projects/classic/download/ projects/cms/download/ security-a mailing-listMailing ListPatch
- [activemq-users] 20190703 Re: ActiveMQ cve vulnerabilities seen in latest version mailing-listIssue TrackingMailing List
- [announce] 20200131 Apache Software Foundation Security Report: 2019 mailing-listMailing ListVendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3088 US Government Resource
CPE-Treffer (NVD) (1)
cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*≥ 5.0.0 < 5.14.0