Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution. In details, in ActiveMQ configurations, jetty allowsorg.jolokia.http.AgentServlet to handler request to /api/jolokia org.jolokia.http.HttpRequestHandler#handlePostRequest is able tocreate JmxRequest throu...
8.8CVSS
8.5AI Score
0.002EPSS
The Java OpenWire protocol marshaller is vulnerable to Remote CodeExecution. This vulnerability may allow a remote attacker with networkaccess to either a Java-based OpenWire broker or client to run arbitraryshell commands by manipulating serialized class types in the OpenWireprotocol to cause eith...