Leon Johnson

**Name of the Vulnerable Software and Affected Versions** Apache ActiveMQ versions prior to 5.19.8 Apache ActiveMQ versions 6.0.0 through 6.2.6 **Description** An improper authorization issue exists where an authenticated user with low privileges can access the `/admin/*` endpoints in the Web Console. This occurs because the default Jetty settings fail to restrict these paths exclusively to administrators. **Recommendations** Upgrade to version 5.19.8. Upgrade to version 6.2.7.

**Name of the Vulnerable Software and Affected Versions** Apache ActiveMQ versions prior to 5.19.8 Apache ActiveMQ versions 6.0.0 through 6.2.6 **Description** An authorization flaw exists in the handling of temporary destinations. While these destinations are intended to be isolated to the connection that created them, the isolation check is only performed on the client side. This allows a different connection to consume messages from another connection's temporary destination. **Recommendations** Upgrade to version 6.2.7.

**Name of the Vulnerable Software and Affected Versions** Apache ActiveMQ versions prior to 5.19.7 Apache ActiveMQ versions 6.0.0 through 6.2.5 **Description** Incomplete authorization in the server allows authenticated connections to remove existing destinations when they possess the proper permissions. **Recommendations** Upgrade to version 5.19.7. Upgrade to version 6.2.6.

**Name of the Vulnerable Software and Affected Versions** Apache ActiveMQ versions prior to 5.19.7 Apache ActiveMQ versions 6.0.0 through 6.2.5 **Description** Incorrect default permissions in Jolokia authorization settings allow authenticated low-privilege web-login accounts to access operations intended for administrators. This enables non-admin users to execute broker management operations, such as `addQueue()` and `removeQueue()`. **Recommendations** Update versions prior to 5.19.7 to version 5.19.7. Update versions 6.0.0 through 6.2.5 to version 6.2.6.