activemq_artemis Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/activemq_artemis/ Sun, 26 Feb 2023 06:37:07 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png activemq_artemis Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/activemq_artemis/ 32 32 CVE-2020-13932 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-13932/ Sun, 26 Feb 2023 06:37:07 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-13932/ In Apache ActiveMQ Artemis 2.5.0 to 2.13.0, a specially crafted MQTT packet which has an XSS payload as client-id or topic name can exploit this vulnerability. The XSS payload is being injected into the admin console’s browser. The XSS payload is triggered in the diagram plugin; queue node and the info section.

The post CVE-2020-13932 appeared first on CVE Vulnerability.

]]> In Apache ActiveMQ Artemis 2.5.0 to 2.13.0, a specially crafted MQTT packet which has an XSS payload as client-id or topic name can exploit this vulnerability. The XSS payload is being injected into the admin console’s browser. The XSS payload is triggered in the diagram plugin; queue node and the info section.

The post CVE-2020-13932 appeared first on CVE Vulnerability.

]]> CVE-2020-10727 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-10727/ Sun, 26 Feb 2023 06:35:56 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-10727/ A flaw was found in ActiveMQ Artemis management API from version 2.7.0 up until 2.12.0, where a user inadvertently stores passwords in plaintext in the Artemis shadow file (etc/artemis-users.properties file) when executing the `resetUsers` operation. A local attacker can use this flaw to read the contents of the Artemis shadow file.

The post CVE-2020-10727 appeared first on CVE Vulnerability.

]]> A flaw was found in ActiveMQ Artemis management API from version 2.7.0 up until 2.12.0, where a user inadvertently stores passwords in plaintext in the Artemis shadow file (etc/artemis-users.properties file) when executing the `resetUsers` operation. A local attacker can use this flaw to read the contents of the Artemis shadow file.

The post CVE-2020-10727 appeared first on CVE Vulnerability.

]]> CVE-2021-26117 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-26117/ Thu, 23 Feb 2023 14:08:17 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-26117/ The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server. In this case, for Apache ActiveMQ Artemis prior to version 2.16.0 and Apache ActiveMQ prior to versions 5.16.1 and 5.15.14, the anonymous context is used to verify a valid users password in error, resulting in no check on […]

The post CVE-2021-26117 appeared first on CVE Vulnerability.

]]> The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server. In this case, for Apache ActiveMQ Artemis prior to version 2.16.0 and Apache ActiveMQ prior to versions 5.16.1 and 5.15.14, the anonymous context is used to verify a valid users password in error, resulting in no check on the password.

The post CVE-2021-26117 appeared first on CVE Vulnerability.

]]> CVE-2021-26118 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-26118/ Thu, 23 Feb 2023 14:08:17 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-26118/ While investigating ARTEMIS-2964 it was found that the creation of advisory messages in the OpenWire protocol head of Apache ActiveMQ Artemis 2.15.0 bypassed policy based access control for the entire session. Production of advisory messages was not subject to access control in error.

The post CVE-2021-26118 appeared first on CVE Vulnerability.

]]> While investigating ARTEMIS-2964 it was found that the creation of advisory messages in the OpenWire protocol head of Apache ActiveMQ Artemis 2.15.0 bypassed policy based access control for the entire session. Production of advisory messages was not subject to access control in error.

The post CVE-2021-26118 appeared first on CVE Vulnerability.

]]> CVE-2022-35278 https://cvevulnerability.com/cve_vulnerabilities/cve-2022-35278/ Thu, 23 Feb 2023 05:19:37 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2022-35278/ In Apache ActiveMQ Artemis prior to 2.24.0, an attacker could show malicious content and/or redirect users to a malicious URL in the web console by using HTML in the name of an address or queue.

The post CVE-2022-35278 appeared first on CVE Vulnerability.

]]> In Apache ActiveMQ Artemis prior to 2.24.0, an attacker could show malicious content and/or redirect users to a malicious URL in the web console by using HTML in the name of an address or queue.

The post CVE-2022-35278 appeared first on CVE Vulnerability.

]]> CVE-2022-23913 https://cvevulnerability.com/cve_vulnerabilities/cve-2022-23913/ Thu, 23 Feb 2023 05:03:09 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2022-23913/ In Apache ActiveMQ Artemis prior to 2.20.0 or 2.19.1, an attacker could partially disrupt availability (DoS) through uncontrolled resource consumption of memory.

The post CVE-2022-23913 appeared first on CVE Vulnerability.

]]> In Apache ActiveMQ Artemis prior to 2.20.0 or 2.19.1, an attacker could partially disrupt availability (DoS) through uncontrolled resource consumption of memory.

The post CVE-2022-23913 appeared first on CVE Vulnerability.

]]>