9.8Kritik
KEV
CVE-2016-3088Apache ActiveMQ Improper Input Validation Vulnerability
Aktif olarak istismar ediliyor — Apache ActiveMQ Improper Input Validation Vulnerability
CISA bu açığın gerçek saldırılarda kullanıldığını 10.02.2022 tarihinde doğruladı. ABD federal kurumları için düzeltme son tarihi: 10.08.2022.
Gerekli işlem: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2016-3088
Açıklama
The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.
Zayıflık türü (CWE):
CWE-434
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
Kaynaklar ve yamalar
- http://www.zerodayinitiative.com/advisories/ZDI-16-356 Third Party AdvisoryVDB Entry
- 42283 exploitExploitThird Party AdvisoryVDB Entry
- http://www.zerodayinitiative.com/advisories/ZDI-16-357 Third Party AdvisoryVDB Entry
- http://activemq.apache.org/security-advisories.data/CVE-2016-3088-announcement.txt Vendor Advisory
- RHSA-2016:2036 vendor-advisoryThird Party Advisory
- 1035951 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
- [activemq-commits] 20190327 svn commit: r1042639 - in /websites/production/activemq/content/activemq-website: ./ projects/artemis/download/ projects/classic/download/ projects/cms/download/ security-a mailing-listMailing ListPatch
- [activemq-users] 20190703 Re: ActiveMQ cve vulnerabilities seen in latest version mailing-listIssue TrackingMailing List
- [announce] 20200131 Apache Software Foundation Security Report: 2019 mailing-listMailing ListVendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3088 US Government Resource
CPE eşleşmeleri (NVD) (1)
cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*≥ 5.0.0 < 5.14.0