Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apache Activemq | — | Upgrade Apache ActiveMQ to the latest version | Jan 9, 2024 | Jan 8, 2016 |
| Debian | — | Upgrade activemq | Mar 28, 2016 | Jan 8, 2016 |
| Freebsd | — | Upgrade activemq | Dec 10, 2025 | Mar 25, 2016 |
| Red Hat Jboss Eap | — | — | Sep 19, 2024 | Dec 8, 2015 |
| Redhat Openshift | — | Upgrade openshift-origin-cartridge-mysqlUpgrade openshift-origin-cartridge-cronUpgrade openshift-enterprise-upgradeUpgrade rubygem-openshift-origin-nodeUpgrade rubygem-openshift-origin-frontend-apache-vhostUpgrade activemqUpgrade openshift-origin-broker-utilUpgrade rubygem-openshift-origin-consoleUpgrade openshift-origin-cartridge-haproxyUpgrade openshift-origin-node-utilUpgrade openshift-origin-node-proxyUpgrade jenkinsUpgrade rubygem-openshift-origin-commonUpgrade rubygem-openshift-origin-controllerUpgrade phpUpgrade openshift-origin-cartridge-phpUpgrade rhcUpgrade openshift-origin-msg-node-mcollectiveUpgrade openshift-origin-cartridge-python | Oct 8, 2019 | Dec 8, 2015 |
| Ubuntu | — | Upgrade activemq | Nov 19, 2024 | Jan 8, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub