Veracode Vulnerability DatabaseVERACODE:44457Deserialization Of Untrusted Data
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7.6 High
AI Score
Confidence
Low
0.002 Low
EPSS
Percentile
54.4%
org.apache.activemq is vulnerable to Deserialization Of Untrusted Data. The vulnerability is due to org.jolokia.http.HttpRequestHandler#handlePostRequest creating a JmxRequest through a JSONObject and calls to org.jolokia.http.HttpRequestHandler#executeRequest. This issue can be exploited by an attacker leading to trigger remote code execution.
References
www.openwall.com/lists/oss-security/2023/11/28/1
activemq.apache.org/security-advisories.data/CVE-2022-41678-announcement.txt
github.com/advisories/GHSA-53v4-42fg-g287
github.com/apache/activemq/commit/6120169e563b55323352431dfe9ac67a8b4de6c2
lists.apache.org/thread/7g17kwbtjl011mm4tr8bn1vnoq9wh4sl
security.netapp.com/advisory/ntap-20240216-0004/
www.openwall.com/lists/oss-security/2023/11/28/1
Related
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7.6 High
AI Score
Confidence
Low
0.002 Low
EPSS
Percentile
54.4%