CVE-2010-1587: Input Validation
The Jetty ResourceHandler in Apache ActiveMQ 5.x before 5.3.2 and 5.4.x before 5.4.0 allows remote attackers to read JSP source code via a // (slash slash) initial substring in a URI for (1) admin/index.jsp, (2) admin/queues.jsp, or (3) admin/topics.jsp.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.apache.activemq:activemq-web-consoleto a version that resolves this vulnerability.Fixed in 5.3.2
Event History
Frequently Asked Questions
What is the severity of CVE-2010-1587?
CVE-2010-1587 is classified as a medium severity vulnerability.
How do I fix CVE-2010-1587?
To fix CVE-2010-1587, upgrade to Apache ActiveMQ version 5.3.2 or later.
What systems are affected by CVE-2010-1587?
CVE-2010-1587 affects Apache ActiveMQ versions 5.0.0 to 5.3.1 and all 5.4.x snapshots prior to 5.4.0.
What kind of attack does CVE-2010-1587 allow?
CVE-2010-1587 allows remote attackers to read JSP source code by exploiting a URI manipulation vulnerability.
What components of Apache ActiveMQ are vulnerable in CVE-2010-1587?
The components affected by CVE-2010-1587 include admin/index.jsp, admin/queues.jsp, and admin/topics.jsp.