9.8Crítica
KEV
CVE-2016-3088Apache ActiveMQ Improper Input Validation Vulnerability
Explotación conocida — Apache ActiveMQ Improper Input Validation Vulnerability
CISA confirmó el 10.02.2022 que esta vulnerabilidad se usa en ataques reales. Plazo para las agencias federales de EE. UU.: 10.08.2022.
Acción requerida: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2016-3088
Descripción
The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.
Debilidad (CWE):
CWE-434
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
Referencias y parches
- http://www.zerodayinitiative.com/advisories/ZDI-16-356 Third Party AdvisoryVDB Entry
- 42283 exploitExploitThird Party AdvisoryVDB Entry
- http://www.zerodayinitiative.com/advisories/ZDI-16-357 Third Party AdvisoryVDB Entry
- http://activemq.apache.org/security-advisories.data/CVE-2016-3088-announcement.txt Vendor Advisory
- RHSA-2016:2036 vendor-advisoryThird Party Advisory
- 1035951 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
- [activemq-commits] 20190327 svn commit: r1042639 - in /websites/production/activemq/content/activemq-website: ./ projects/artemis/download/ projects/classic/download/ projects/cms/download/ security-a mailing-listMailing ListPatch
- [activemq-users] 20190703 Re: ActiveMQ cve vulnerabilities seen in latest version mailing-listIssue TrackingMailing List
- [announce] 20200131 Apache Software Foundation Security Report: 2019 mailing-listMailing ListVendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3088 US Government Resource
Coincidencias CPE (NVD) (1)
cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*≥ 5.0.0 < 5.14.0