PT-2024-3291 · Apache · Apache Activemq

Martin Zeissig · Published 2024-04-11 · Updated 2026-05-14 · CVE-2024-32114

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache ActiveMQ versions prior to 6.1.2

Description The default configuration does not secure the API web context, which houses the Jolokia JMX REST API and the Message REST API. This allows unauthorized users to access these layers without authentication. Consequently, an attacker can interact with the broker via the Jolokia JMX REST API or use the Message REST API to produce, consume, purge, or delete messages and destinations. Real-world exploitation of this issue has been detected.

Recommendations Upgrade to version 6.1.2. As a temporary workaround, update the conf/jetty.xml configuration file to add authentication requirements by configuring the securityConstraintMapping bean with the pathSpec variable set to '/'.

Fix

Missing Authentication

Weakness Enumeration

CWE-1188

CWE-306

Related Identifiers

BDU:2024-03523

BIT-ACTIVEMQ-2024-32114

CVE-2024-32114

GHSA-GJ5M-M88J-V7C3

Affected Products

Apache Activemq

References · 51

• https://activemq.apache.org/security-advisories.data/CVE-2024-32114-announcement.txt · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-03523 · Security Note
• https://osv.dev/vulnerability/GHSA-gj5m-m88j-v7c3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-32114 · Security Note
• https://osv.dev/vulnerability/CVE-2024-32114 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-activemq-2024-32114 · Vendor Advisory
• https://github.com/apache/activemq · Note
• https://github.com/apache/activemq/commit/43cc596219b6a8c8b5a54fbda3fb68cb4424f2d0 · Note
• https://github.com/apache/activemq/pull/1201 · Note
• https://twitter.com/SecureChap/status/2045896293671727407 · Twitter Post
• https://twitter.com/cantinasecurity/status/2048768635796353410 · Twitter Post
• https://twitter.com/codewithsamzy/status/2043629675381993631 · Twitter Post
• https://vuldb.com/?id.262788 · Note
• https://reddit.com/r/CVEWatch/comments/1sted13/top_10_trending_cves_23042026 · Reddit Post
• https://twitter.com/Dinosn/status/1785989187939790933 · Twitter Post