Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apache Activemq | — | Upgrade Apache ActiveMQ to the latest version | Jan 9, 2024 | Jan 8, 2016 |
| Debian | — | Upgrade activemq | Mar 28, 2016 | Jan 8, 2016 |
| Freebsd | — | Upgrade activemq | Dec 10, 2025 | Mar 25, 2016 |
| Red Hat Jboss Eap | — | — | Sep 19, 2024 | Dec 8, 2015 |
| Redhat Openshift | — | Upgrade openshift-origin-node-proxyUpgrade phpUpgrade rubygem-openshift-origin-controllerUpgrade rubygem-openshift-origin-commonUpgrade openshift-origin-node-utilUpgrade rhcUpgrade openshift-origin-msg-node-mcollectiveUpgrade openshift-origin-cartridge-phpUpgrade jenkinsUpgrade openshift-origin-cartridge-pythonUpgrade rubygem-openshift-origin-frontend-apache-vhostUpgrade openshift-enterprise-upgradeUpgrade rubygem-openshift-origin-consoleUpgrade activemqUpgrade openshift-origin-cartridge-mysqlUpgrade openshift-origin-cartridge-haproxyUpgrade rubygem-openshift-origin-nodeUpgrade openshift-origin-cartridge-cronUpgrade openshift-origin-broker-util | Oct 8, 2019 | Dec 8, 2015 |
| Ubuntu | — | Upgrade activemq | Nov 19, 2024 | Jan 8, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub