Към съдържанието
Търсене

CVE-2026-41044: Apache Software Foundation Apache ActiveMQ, инжекция

8.8

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се по мрежата, без особени условия, с обикновен потребителски вход и без действие от потребителя.

CVE радар: още уязвимости от този вид

  • Експлоатация: няма данни за експлоатация
  • Атаката не може да се автоматизира

Описание

Оригинално описание

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All. An authenticated attacker can use the admin web console page to construct a malicious broker name that bypasses name validation to include an xbean binding that can be later used by a VM transport to load a remote Spring XML application. The attacker can then use the DestinationView mbean to send a message to trigger a VM transport creation that will reference this malicious broker name which can lead to loading the malicious Spring XML context file. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec(). This issue affects Apache ActiveMQ: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ Broker: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ All: before 5.19.6, from 6.0.0 before 6.2.5. Users are recommended to upgrade to version 6.2.5 or 5.19.6, which fixes the issue.

Засегнати продукти

  • Apache Software Foundation Apache ActiveMQ: преди 5.19.6; 6.0.0 преди 6.2.5
  • Apache Software Foundation Apache ActiveMQ Broker: преди 5.19.6; 6.0.0 преди 6.2.5
  • Apache Software Foundation Apache ActiveMQ All: преди 5.19.6; 6.0.0 преди 6.2.5
  • Red Hat: още 8 продукта, добавени от Red Hat

    Red Hat AMQ Broker 7, Red Hat Data Grid 8, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Fuse 7, Red Hat JBoss Enterprise Application Platform 7, Red Hat JBoss Enterprise Application Platform 8, Red Hat JBoss Enterprise Application Platform Expansion Pack

Вид слабост

История

  • 24 април 2026 Публикувано

Други уязвимости в Apache Software Foundation Apache ActiveMQ

Първоизточници

CVE-2026-41044: Apache Software Foundation Apache ActiveMQ, инжекция | freedomonline.bg