Veille CVE
CVE-2016-3088
9.8 Critique Exploitée activementCatalogue CISA KEV — Apache ActiveMQ Improper Input Validation Vulnerability
Ajoutée le 10/02/2022 · Échéance de correction (agences US) : 10/08/2022
Action requise : Apply updates per vendor instructions.
Description
The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.
Produits concernés
Scores CVSS
| Version | Score | Source | Vecteur |
|---|---|---|---|
| 3.1 | 9.8 Critique | nvd@nist.gov (NVD) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | 9.8 Critique | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 2.0 | 7.5 Élevée | nvd@nist.gov (NVD) | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Faiblesses (CWE)
Références
- http://activemq.apache.org/security-advisories.data/CVE-2016-3088-announcement.txt Vendor Advisory
- http://rhn.redhat.com/errata/RHSA-2016-2036.html Third Party Advisory
- http://www.securitytracker.com/id/1035951 Broken LinkThird Party AdvisoryVDB Entry
- http://www.zerodayinitiative.com/advisories/ZDI-16-356 Third Party AdvisoryVDB Entry
- http://www.zerodayinitiative.com/advisories/ZDI-16-357 Third Party AdvisoryVDB Entry
- https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apache.org%3E Mailing ListPatch
- https://lists.apache.org/thread.html/f956ea38e4da2e2c1e7131e6f91e41754852f5a4861d1a14ca5ca78a%40%3Cusers.activemq.apache.org%3E Issue TrackingMailing List
- https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E Mailing ListVendor Advisory
- https://www.exploit-db.com/exploits/42283/ ExploitThird Party AdvisoryVDB Entry
- http://activemq.apache.org/security-advisories.data/CVE-2016-3088-announcement.txt Vendor Advisory
- http://rhn.redhat.com/errata/RHSA-2016-2036.html Third Party Advisory
- http://www.securitytracker.com/id/1035951 Broken LinkThird Party AdvisoryVDB Entry
- http://www.zerodayinitiative.com/advisories/ZDI-16-356 Third Party AdvisoryVDB Entry
- http://www.zerodayinitiative.com/advisories/ZDI-16-357 Third Party AdvisoryVDB Entry
- https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apache.org%3E Mailing ListPatch
- https://lists.apache.org/thread.html/f956ea38e4da2e2c1e7131e6f91e41754852f5a4861d1a14ca5ca78a%40%3Cusers.activemq.apache.org%3E Issue TrackingMailing List
- https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E Mailing ListVendor Advisory
- https://www.exploit-db.com/exploits/42283/ ExploitThird Party AdvisoryVDB Entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3088 US Government Resource