275 matches found
CVE-2023-50780 Apache ActiveMQ Artemis: Authenticated users could perform RCE via Jolokia MBeans
Apache ActiveMQ Artemis allows access to diagnostic information and controls through MBeans, which are also exposed through the authenticated Jolokia endpoint. Before version 2.29.0, this also included the Log4J2 MBean. This MBean is not meant for exposure to non-administrative users. This could...
CVE-2023-50780 Apache ActiveMQ Artemis: Authenticated users could perform RCE via Jolokia MBeans
Apache ActiveMQ Artemis allows access to diagnostic information and controls through MBeans, which are also exposed through the authenticated Jolokia endpoint. Before version 2.29.0, this also included the Log4J2 MBean. This MBean is not meant for exposure to non-administrative users. This could...
VulnCheck KEV: CVE-2021-40684
Talend ESB Runtime in all versions from 5.1 to 7.3.1-R2021-09, 7.2.1-R2021-09, 7.1.1-R2021-09, has an unauthenticated Jolokia HTTP endpoint which allows remote access to the JMX of the runtime container, which would allow an attacker the ability to read or modify the container or software running...
ActiveMQ: Deserialization vulnerability on Jolokia that allows authenticated users to perform RCE
A vulnerability in ActiveMQ's Jolokia integration, where an authenticated user can potentially execute arbitrary code on the server. The vulnerability stems from the ability to handle and manipulate JMX requests through Jolokia's HttpRequestHandler, allowing an attacker to exploit the...
ActiveMQ: Deserialization vulnerability on Jolokia that allows authenticated users to perform RCE
A vulnerability in ActiveMQ's Jolokia integration, where an authenticated user can potentially execute arbitrary code on the server. The vulnerability stems from the ability to handle and manipulate JMX requests through Jolokia's HttpRequestHandler, allowing an attacker to exploit the...
The vulnerability of the interface configurations of the Jolokia JMX REST API and the Message REST API of the Apache ActiveMQ software platform allows a perpetrator to gain access to read, modify, or delete information.
The vulnerability of the Jolokia JMX REST API and Message REST API interface configurations of the Apache ActiveMQ software platform is related to insecure resource initialization due to the absence of authentication procedures. Exploiting this vulnerability could allow an attacker to gain read,...
BIT-ACTIVEMQ-2024-32114
In Apache ActiveMQ 6.x, the default configuration doesn't secure the API web context where the Jolokia JMX REST API and the Message REST API are located.It means that anyone can use these layers without any required authentication. Potentially, anyone can interact with the broker using Jolokia JM...
Improper Access Control
Apache ActiveMQ is vulnerable to Improper Access Control. The vulnerability is due to a default configuration which does not secure the API web context, allowing unrestricted use of the Jolokia JMX REST API and the Message REST API. This vulnerability potentially enables anyone to interact with t...
CVE-2024-32114
A flaw was found in Apache ActiveMQ. This vulnerability contains an insecure default configuration in Jolokia and REST API, allowing any user to bypass security restrictions. The vulnerability exists due to missing authorization in the application's REST API. The default configuration doesn't...
GHSA-GJ5M-M88J-V7C3 Apache ActiveMQ's default configuration doesn't secure the API web context
In Apache ActiveMQ 6.x, the default configuration doesn't secure the API web context where the Jolokia JMX REST API and the Message REST API are located. It means that anyone can use these layers without any required authentication. Potentially, anyone can interact with the broker using Jolokia J...
CVE-2024-32114
In Apache ActiveMQ 6.x, the default configuration doesn't secure the API web context where the Jolokia JMX REST API and the Message REST API are located. It means that anyone can use these layers without any required authentication. Potentially, anyone can interact with the broker using Jolokia J...
CVE-2024-32114
In Apache ActiveMQ 6.x, the default configuration doesn't secure the API web context where the Jolokia JMX REST API and the Message REST API are located. It means that anyone can use these layers without any required authentication. Potentially, anyone can interact with the broker using Jolokia J...
CVE-2024-32114 Apache ActiveMQ: Jolokia and REST API were not secured with default configuration
In Apache ActiveMQ 6.x, the default configuration doesn't secure the API web context where the Jolokia JMX REST API and the Message REST API are located. It means that anyone can use these layers without any required authentication. Potentially, anyone can interact with the broker using Jolokia J...
CVE-2024-32114 Apache ActiveMQ: Jolokia and REST API were not secured with default configuration
In Apache ActiveMQ 6.x, the default configuration doesn't secure the API web context where the Jolokia JMX REST API and the Message REST API are located. It means that anyone can use these layers without any required authentication. Potentially, anyone can interact with the broker using Jolokia J...
PT-2024-3291
Name of the Vulnerable Software and Affected Versions Apache ActiveMQ versions 6.x prior to 6.1.2 Description The default configuration does not secure the API web context, leading to insecure resource initialization due to a lack of authentication. This allows remote attackers to use the Jolokia...
Fedora: Security Advisory for jolokia-jvm-agent (FEDORA-2024-129d8ca6fc)
The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
[SECURITY] Fedora 40 Update: jolokia-jvm-agent-1.6.2-17.fc40
Jolokia JVM Agent...
VulnCheck KEV: CVE-2018-1000130
A JNDI Injection vulnerability exists in Jolokia agent version 1.3.7 in the proxy mode that allows a remote attacker to run arbitrary Java code on the server...
OESA-2023-1925 activemq security update
The most popular and powerful open source messaging and Integration Patterns server. Security Fixes: Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution. In details, in ActiveMQ configurations, jetty allows org.jolokia.http.AgentServlet to handler request...
PT-2023-9583
Name of the Vulnerable Software and Affected Versions Apache ActiveMQ Artemis versions prior to 2.29.0 Description The issue is related to the exposure of diagnostic information and controls through MBeans, which are also accessible through the authenticated Jolokia endpoint. This includes the...