PT-2010-3257 · Apache · Apache Activemq

Published 2010-04-28 · Updated 2022-05-14 · CVE-2010-1587

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache ActiveMQ versions 5.0.0 through 5.3.1 Apache ActiveMQ versions 5.4.0 and earlier

Description The issue allows remote attackers to read JSP source code via a // (slash slash) initial substring in a URI for certain JSP files, including admin/index.jsp, admin/queues.jsp, and admin/topics.jsp.

Recommendations For Apache ActiveMQ versions 5.0.0 through 5.3.1, update to version 5.3.2 or later. For Apache ActiveMQ versions 5.4.0 and earlier, update to version 5.4.0 or later.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2010-1587

GHSA-V2C9-9M8V-8JJM

Affected Products

Apache Activemq

References · 20

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/apache_activemq_source_disclosure.rb · Exploit
• 🔥 http://osvdb.org/64020 · Exploit
• 🔥 https://exploit-db.com/exploits/33868 · Exploit
• https://issues.apache.org/activemq/browse/AMQ-2700 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2010-1587 · Security Note
• http://vupen.com/english/advisories/2010/0979 · Vendor Advisory
• http://secunia.com/advisories/39567 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-v2c9-9m8v-8jjm · Vendor Advisory
• https://github.com/apache/activemq · Note
• https://github.com/apache/activemq/tree/main/activemq-web-console/src/main/webapp · Note
• https://github.com/apache/activemq/compare/activemq-5.3.1...activemq-parent-5.3.2 · Note
• https://github.com/apache/activemq/commit/aadd17ab7b6b6a664322538d25ee96dad67616e0 · Note
• https://web.archive.org/web/20100426064914/http://vupen.com/english/advisories/2010/0979 · Note
• http://securityfocus.com/bid/39636 · Note
• https://web.archive.org/web/20201208002259/http://securityfocus.com/archive/1/510896/100/0/threaded · Note