apache/activemq · Security
Improper Input Validation and Missing Authentication for Critical Function in Apache ActiveMQ
- GHSA ID
- GHSA-jvpp-hxjj-5ccc
- CVE ID
- CVE-2015-7559
- Severity
- medium
- Published
- Updated
- CVSS
- 4.9 · CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
- CVSS v3
- 4.9 · CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Description
It was found that the Apache ActiveMQ client before 5.14.5 exposed a remote shutdown command in the ActiveMQConnection class. An attacker logged into a compromised broker could use this flaw to achieve denial of service on a connected client.
CWEs
- CWE-20 · Improper Input Validation
- CWE-306 · Missing Authentication for Critical Function