PT-2015-3325 · Red Hat · Red Hat Amq

Naftali Rosenbaum · Published 2015-07-31 · Updated 2021-01-05 · CVE-2015-5183

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Red Hat AMQ (affected versions not specified)

Description The issue is related to the absence of HTTPOnly and Secure attributes on cookies in the console of Red Hat AMQ. This could allow a remote attacker to reuse the session identifier of an authenticated user.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-254

Related Identifiers

BDU:2017-02346

CVE-2015-5183

Affected Products

Red Hat Amq

References · 10

• https://bdu.fstec.ru/vul/2017-02346 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1249182 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:2840 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-5183 · Security Note
• https://lists.apache.org/thread.html/r63480b481eb5922465da102d97d0906d8823687f99ef3255ebc32be8%40%3Cdev.activemq.apache.org%3E · Note
• https://lists.apache.org/thread.html/9e3391878c6840b294155f7ba6ccb47586e317f85c1bbd15c4608bd0%40%3Cdev.activemq.apache.org%3E · Note
• https://lists.apache.org/thread.html/r51c60b28154fe7b634e5f5b7a7fc7f6f060487b39a7b5e95e2c32047%40%3Cdev.activemq.apache.org%3E · Note
• https://lists.apache.org/thread.html/rb280e767ab199767e07a367f287ba08a9692fa76e2da4a20d50d07c4%40%3Cdev.activemq.apache.org%3E · Note
• https://t.me/cvenotify/8182 · Telegram Post
• http://securitytracker.com/id/1041750 · Note