PT-2020-13781 · Apache+2 · Apache Activemq+2

CVE-2020-13920 · Publicado 2020-09-10 · Atualizado 2024-07-23

Positive Technologies (AI Summary) · Pt

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Nome do software vulnerável e versões afetadas

Versões do Apache ActiveMQ anteriores à 5.15.12

Descrição

A vulnerabilidade permite que um invasor se conecte ao registro JMX RMI sem autenticação e re-vincule a entrada jmxrmi. Ao criar um servidor proxy, um invasor pode interceptar as credenciais do usuário.

Recomendações

Para versões anteriores à 5.15.12, atualize para o Apache ActiveMQ 5.15.12 para resolver o problema.

Exploit

Correção

DoS

Missing Authentication

Enumeração de Fraquezas

CWE-306

Identificadores relacionados

BIT-ACTIVEMQ-2020-13920

CVE-2020-13920

DLA-2400-1

DLA-3657-1

GHSA-XGRX-XPV2-6VP4

USN-6910-1

Produtos afetados

Apache Activemq

Linuxmint

Ubuntu

Referências · 43

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/misc/apache_activemq_rce_cve_2023_46604.rb · Exploit
• 🔥 https://github.com/SaumyajeetDas/CVE-2023-46604-RCE-Reverse-Shell-Apache-ActiveMQ · Exploit
• 🔥 https://github.com/evkl1d/CVE-2023-46604 · Exploit
• 🔥 https://github.com/Arlenhiack/ActiveMQ-RCE-Exploit · Exploit
• 🔥 https://github.com/sule01u/CVE-2023-46604 · Exploit
• 🔥 https://github.com/duck-sec/CVE-2023-46604-ActiveMQ-RCE-pseudoshell · Exploit
• 🔥 https://github.com/justdoit-cai/CVE-2023-46604-Apache-ActiveMQ-RCE-exp · Exploit
• 🔥 https://github.com/h3x3h0g/ActiveMQ-RCE-CVE-2023-46604-Write-up · Exploit
• https://github.com/apache/activemq · Nota
• https://github.com/apache/activemq/commit/b7dca5e · Nota
• https://github.com/apache/activemq/commit/58382283330f7c7b110c7afd8ef4ca2648786532 · Nota
• https://github.com/apache/activemq/commit/359ae4b · Nota
• https://github.com/apache/activemq/commit/48cd61d · Nota
• https://ubuntu.com/security/CVE-2015-7559 · Aviso do Fabricante
• https://lists.apache.org/thread.html/rb2fd3bf2dce042e0ab3f3c94c4767c96bb2e7e6737624d63162df36d%40%3Ccommits.activemq.apache.org%3E · Nota