CVE-2024-32114

2024-05-0209:15:06

CWE-1188

[email protected]

web.nvd.nist.gov

apache activemq

web context

security vulnerability

authentication

rest api

jolokia jmx

message rest api

apache activemq 6.1.2

8.5 High

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:H

8.7 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

In Apache ActiveMQ 6.x, the default configuration doesn’t secure the API web context (where the Jolokia JMX REST API and the Message REST API are located).
It means that anyone can use these layers without any required authentication. Potentially, anyone can interact with the broker (using Jolokia JMX REST API) and/or produce/consume messages or purge/delete destinations (using the Message REST API).

To mitigate, users can update the default conf/jetty.xml configuration file to add authentication requirement:
<bean id=“securityConstraintMapping” class=“org.eclipse.jetty.security.ConstraintMapping”>
<property name=“constraint” ref=“securityConstraint” />
<property name=“pathSpec” value=“/” />
</bean>

Or we encourage users to upgrade to Apache ActiveMQ 6.1.2 where the default configuration has been updated with authentication by default.