PT-2018-2280 · Apache+2 · Apache Activemq+2

Publicado 2018-09-10 · Atualizado 2024-07-23 · CVE-2018-11775

Positive Technologies (AI Summary)

CVSS v3.1

7.4

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache ActiveMQ versions prior to 5.15.6

Description The issue is related to errors in security settings and the absence of TLS hostname verification in the Apache ActiveMQ broker. This could allow a remote attacker to implement a man-in-the-middle attack, potentially gaining unauthorized access to protected data.

Recommendations For versions prior to 5.15.6, update to version 5.15.6 or later to enable TLS hostname verification by default. As a temporary workaround, consider configuring the Apache ActiveMQ client to enable TLS hostname verification manually until a patch is applied.

Exploit

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-254

CWE-295

Identificadores relacionados

BDU:2019-00382

BDU:2019-01768

CVE-2018-11775

DLA-2583-1

GHSA-M9W8-V359-9FFR

USN-6910-1

Produtos afetados

Apache Activemq

Linuxmint

Ubuntu

Referências · 53

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/misc/apache_activemq_rce_cve_2023_46604.rb · Exploit
• 🔥 https://github.com/SaumyajeetDas/CVE-2023-46604-RCE-Reverse-Shell-Apache-ActiveMQ · Exploit
• 🔥 https://github.com/evkl1d/CVE-2023-46604 · Exploit
• 🔥 https://github.com/Arlenhiack/ActiveMQ-RCE-Exploit · Exploit
• 🔥 https://github.com/sule01u/CVE-2023-46604 · Exploit
• 🔥 https://github.com/duck-sec/CVE-2023-46604-ActiveMQ-RCE-pseudoshell · Exploit
• 🔥 https://github.com/justdoit-cai/CVE-2023-46604-Apache-ActiveMQ-RCE-exp · Exploit
• 🔥 https://github.com/h3x3h0g/ActiveMQ-RCE-CVE-2023-46604-Write-up · Exploit
• https://github.com/apache/activemq · Nota
• https://github.com/apache/activemq/commit/bde7097fb8173cf871827df7811b3865679b963d · Nota
• https://github.com/apache/activemq/commit/02971a40e281713a8397d3a1809c164b594abfbb · Nota
• http://securityfocus.com/bid/105335 · Nota
• https://oracle.com/security-alerts/cpujan2021.html · Nota
• https://ubuntu.com/security/CVE-2020-13920 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-11775 · Aviso do Fabricante