PT-2015-3324 · Red Hat+1 · Red Hat Amq+1

Colm O Heigeartaigh · Published 2015-07-31 · Updated 2021-01-05 · CVE-2015-5184

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Red Hat AMQ (affected versions not specified) Apache ActiveMQ (affected versions not specified)

Description The issue is related to errors in security settings of the Hawtio web console in Apache ActiveMQ, which allows CORS headers to be set to allow all in Red Hat AMQ. This could potentially allow a remote attacker to obtain confidential information or exert other influence.

Recommendations For Red Hat AMQ, consider restricting access to the web console until a fix is available. For Apache ActiveMQ, restrict access to the Hawtio web console to minimize the risk of exploitation. As a temporary workaround, consider disabling the CORS headers setting in the affected systems until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-254

Related Identifiers

BDU:2017-02345

CVE-2015-5184

Affected Products

Apache Activemq

Red Hat Amq

References · 6

• https://bdu.fstec.ru/vul/2017-02345 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1249183 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-5184 · Security Note
• https://lists.apache.org/thread.html/rb280e767ab199767e07a367f287ba08a9692fa76e2da4a20d50d07c4%40%3Cdev.activemq.apache.org%3E · Note
• https://lists.apache.org/thread.html/9e3391878c6840b294155f7ba6ccb47586e317f85c1bbd15c4608bd0%40%3Cdev.activemq.apache.org%3E · Note
• https://t.me/cvenotify/8181 · Telegram Post