PT-2010-2949 · Apache · Apache Activemq

Publicado 2010-04-05 · Atualizado 2022-05-02 · CVE-2010-1244

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apache ActiveMQ versions prior to 5.3.1

Description A cross-site request forgery (CSRF) issue exists, allowing remote attackers to hijack the authentication of victims for requests that create queues. This is achieved via the JMSDestination parameter in a queue action, specifically in the createDestination.action endpoint.

Recommendations For versions prior to 5.3.1, update to version 5.3.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the createDestination.action endpoint to minimize the risk of exploitation. Avoid using the JMSDestination parameter in the affected endpoint until the issue is resolved.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2010-1244

GHSA-33J4-8VCR-F79V

Produtos afetados

Apache Activemq

Referências · 10

• 🔥 https://issues.apache.org/activemq/browse/AMQ-2625 · Exploit
• 🔥 https://issues.apache.org/activemq/browse/AMQ-2613 · Exploit
• https://github.com/apache/activemq · Nota
• https://github.com/apache/activemq/commit/1f464b9412e1b1c08d40c8ffac40edd52731da48 · Nota
• https://github.com/apache/activemq/commit/f3d4034e2a7cee7b1f88c7e6b0d1d69458e1bcf0 · Nota
• http://secunia.com/advisories/39223 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-33j4-8vcr-f79v · Aviso do Fabricante
• http://activemq.apache.org/activemq-531-release.html · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2010-1244 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/57398 · Nota