Skip to main content
Skip table of contents

Maintenance - Security Threat: ActiveMQ version 5.15.12




One of our clients has detected a vulnerability on Active MQ. Vulnerability details below.

Apache ActiveMQ JMX Remote Code Execution Active
Category: CGI
Vendor Reference: Apache ActiveMQ JMX
Apache ActiveMQ is an open source message broker written in Java together with a full Java Message Service (JMS) client.
A regression has been introduced in the commit preventing JMX re-bind. By passing an empty environment map to RMIConnectorServer, instead of
the map that contains the authentication credentials, it leaves ActiveMQ open to the following attack: 
technotes/guides/management/agent.html "A remote client could create a MBean and use it to create new MBeans
from arbitrary URLs, at least if there is no security manager. In other words, a rogue remote client could make your Java application execute arbitrary
Affected Versions: Apache ActiveMQ 5.15.12
QID Detection Logic (Unauthenticated):
This qid checks for a vulnerable version of ActiveMQ from /admin/index.jsp file.
QID Detection Logic (Authenticated):
This qid checks for a vulnerable version of ActiveMQ from running process and querying activemq --version command.
IMPACT: Successful exploitation could allow an attacker to execute arbitrary code on a Java application

SOLUTION: Upgrade to Apache ActiveMQ 5.15.13 or later (ActiveMQ Download) to resolve this.

JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.