CVE-2015-5254: Input Validation
Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object.
Other sources
Apache ActiveMQ could allow a remote attacker to execute arbitrary code on the system, caused by the failure to restrict the classes that can be serialized in the broker. An attacker could exploit this vulnerability using a specially crafted serialized Java Message Service (JMS) ObjectMessage object to execute arbitrary code on the system.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2015-5254?
CVE-2015-5254 is a vulnerability in Apache ActiveMQ 5.x before 5.13.0 that allows a remote attacker to execute arbitrary code on the system.
How severe is CVE-2015-5254?
CVE-2015-5254 has a severity rating of 9.8 (critical).
How does CVE-2015-5254 affect Apache ActiveMQ?
CVE-2015-5254 affects Apache ActiveMQ versions 5.0.0 to 5.12.1.
How can an attacker exploit CVE-2015-5254?
An attacker can exploit CVE-2015-5254 by using a specially crafted serialized Java Message Service (JMS) ObjectMessage object.
Where can I find more information about CVE-2015-5254?
You can find more information about CVE-2015-5254 in the Apache ActiveMQ security advisory and the Fedora Project mailing list.