PT-2021-16958 · Apache+2 · Apache Activemq+3

Published 2021-01-27 · Updated 2026-06-15 · CVE-2021-26117

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache ActiveMQ Artemis versions prior to 2.16.0 Apache ActiveMQ versions prior to 5.16.1 Apache ActiveMQ versions prior to 5.15.14

Description The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server. In this case, the anonymous context is used to verify a valid user's password in error, resulting in no check on the password.

Recommendations For Apache ActiveMQ Artemis versions prior to 2.16.0, update to version 2.16.0 or later. For Apache ActiveMQ versions prior to 5.16.1, update to version 5.16.1 or later. For Apache ActiveMQ versions prior to 5.15.14, update to version 5.15.14 or later. As a temporary workaround, consider disabling the anonymous access to the LDAP server until a patch is available.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BIT-ACTIVEMQ-2021-26117

CVE-2021-26117

DLA-2583-1

DLA-3657-1

GHSA-9MGM-GCQ8-86WQ

USN-6910-1

Affected Products

Apache Activemq

Apache Activemq Artemis

Linuxmint

Ubuntu

References · 76

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/misc/apache_activemq_rce_cve_2023_46604.rb · Exploit
• 🔥 https://github.com/SaumyajeetDas/CVE-2023-46604-RCE-Reverse-Shell-Apache-ActiveMQ · Exploit
• 🔥 https://github.com/evkl1d/CVE-2023-46604 · Exploit
• 🔥 https://github.com/Arlenhiack/ActiveMQ-RCE-Exploit · Exploit
• 🔥 https://github.com/sule01u/CVE-2023-46604 · Exploit
• 🔥 https://github.com/duck-sec/CVE-2023-46604-ActiveMQ-RCE-pseudoshell · Exploit
• 🔥 https://github.com/justdoit-cai/CVE-2023-46604-Apache-ActiveMQ-RCE-exp · Exploit
• 🔥 https://github.com/h3x3h0g/ActiveMQ-RCE-CVE-2023-46604-Write-up · Exploit
• https://ubuntu.com/security/CVE-2018-11775 · Vendor Advisory
• https://oracle.com//security-alerts/cpujul2021.html · Patch
• https://ubuntu.com/security/CVE-2020-13920 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-26117 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-activemq-2021-26117 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-26117 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6910-1 · Vendor Advisory