GitHub Advisory DatabaseGHSA-33J4-8VCR-F79VCross-site request forgery in Apache ActiveMQ
6.8 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
7.7 High
AI Score
Confidence
Low
0.001 Low
EPSS
Percentile
46.1%
Cross-site request forgery (CSRF) vulnerability in createDestination.action in Apache ActiveMQ before 5.3.1 allows remote attackers to hijack the authentication of unspecified victims for requests that create queues via the JMSDestination parameter in a queue action.
Affected configurations
| CPE | Name | Operator | Version |
|---|---|---|---|
| org.apache.activemq:activemq-parent | lt | 5.3.1 |
References
activemq.apache.org/activemq-531-release.html
secunia.com/advisories/39223
exchange.xforce.ibmcloud.com/vulnerabilities/57398
github.com/advisories/GHSA-33j4-8vcr-f79v
github.com/apache/activemq/commit/1f464b9412e1b1c08d40c8ffac40edd52731da48
github.com/apache/activemq/commit/f3d4034e2a7cee7b1f88c7e6b0d1d69458e1bcf0
issues.apache.org/activemq/browse/AMQ-2613
issues.apache.org/activemq/browse/AMQ-2625
nvd.nist.gov/vuln/detail/CVE-2010-1244
Related
6.8 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
7.7 High
AI Score
Confidence
Low
0.001 Low
EPSS
Percentile
46.1%