cyfenced.com →

[ CVE-2016-3088 · Published 1 Jun 2016 ]

Apache ActiveMQ Improper Input Validation Vulnerability

Exploited · CISA KEV CVSS 9.8 EPSS 99%Fix available

[ Why it matters ]Priority signals

  • Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-02-10
  • EPSS: 99% chance of exploitation in the next 30 days (higher than 100% of CVEs)
  • Critical severity: CVSS 9.8

[ Description ]Official description

The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.

CISA: The Fileserver web application in Apache ActiveMQ allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 10 Aug 2022): Apply updates per vendor instructions.

[ References ]References