PT-2024-34531 · Hornetq · Hornetq

Published 2024-11-04 · Updated 2024-11-06 · CVE-2024-51127

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: hornetq version 2.4.9

Description: An issue in the createTempFile method allows attackers to arbitrarily overwrite files or access sensitive information.

Recommendations: For hornetq version 2.4.9, consider disabling the createTempFile method until a patch is available to prevent arbitrary file overwrites and sensitive information access.

Exploit

Fix

Path traversal

Information Disclosure

Weakness Enumeration

CWE-22

CWE-200

Related Identifiers

CVE-2024-51127

GHSA-R7MV-MV7M-PJW3

RHSA-2024:11529

RHSA-2024:11559

RHSA-2024:11560

RHSA-2025:0371

RHSA-2025:1636

RHSA-2025:1637

RHSA-2025:1638

RHSA-2025:16667

RHSA-2025:16668

Affected Products

Hornetq

References · 10

• 🔥 https://github.com/JAckLosingHeart/CWE-378/blob/main/CVE-2024-51127.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-51127 · Security Note
• https://osv.dev/vulnerability/GHSA-r7mv-mv7m-pjw3 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-51127 · Vendor Advisory
• https://github.com/hornetq/hornetq/blob/HornetQ_2_4_9_Final/hornetq-core-client/src/main/java/org/hornetq/core/client/impl/ClientConsumerImpl.java#L665C35-L665C49 · Note
• https://twitter.com/VulmonFeeds/status/1853599841802219781 · Twitter Post
• https://t.me/cvedetector/9772 · Telegram Post
• https://twitter.com/CVEnew/status/1853490405884531147 · Twitter Post
• https://github.com/darranl/hornetq · Note
• http://hornetq.com · Note