PT-2010-2949 · Apache · Apache Activemq

Published 2010-04-05 · Updated 2022-05-02 · CVE-2010-1244

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apache ActiveMQ versions prior to 5.3.1

Description A cross-site request forgery (CSRF) issue exists, allowing remote attackers to hijack the authentication of victims for requests that create queues. This is achieved via the JMSDestination parameter in a queue action, specifically in the createDestination.action endpoint.

Recommendations For versions prior to 5.3.1, update to version 5.3.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the createDestination.action endpoint to minimize the risk of exploitation. Avoid using the JMSDestination parameter in the affected endpoint until the issue is resolved.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2010-1244

GHSA-33J4-8VCR-F79V

Affected Products

Apache Activemq

References · 10

• 🔥 https://issues.apache.org/activemq/browse/AMQ-2625 · Exploit
• 🔥 https://issues.apache.org/activemq/browse/AMQ-2613 · Exploit
• http://secunia.com/advisories/39223 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-33j4-8vcr-f79v · Vendor Advisory
• http://activemq.apache.org/activemq-531-release.html · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2010-1244 · Security Note
• https://github.com/apache/activemq · Note
• https://github.com/apache/activemq/commit/1f464b9412e1b1c08d40c8ffac40edd52731da48 · Note
• https://github.com/apache/activemq/commit/f3d4034e2a7cee7b1f88c7e6b0d1d69458e1bcf0 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/57398 · Note